Bill Full Text
Home
-
Bills
-
Bill
-
Authors
-
Dates
-
Locations
-
Analyses
-
Organizations
<?xml version="1.0" ?>
<ns0:MeasureDoc xmlns:html="http://www.w3.org/1999/xhtml" xmlns:ns0="http://lc.ca.gov/legalservices/schemas/caml.1#" xmlns:ns3="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" version="1.0" xsi:schemaLocation="http://lc.ca.gov/legalservices/schemas/caml.1# xca.1.xsd">
<ns0:Description>
<ns0:Id>20250AB__228598AMD</ns0:Id>
<ns0:VersionNum>98</ns0:VersionNum>
<ns0:History>
<ns0:Action>
<ns0:ActionText>INTRODUCED</ns0:ActionText>
<ns0:ActionDate>2026-02-19</ns0:ActionDate>
</ns0:Action>
<ns0:Action>
<ns0:ActionText>AMENDED_ASSEMBLY</ns0:ActionText>
<ns0:ActionDate>2026-03-16</ns0:ActionDate>
</ns0:Action>
</ns0:History>
<ns0:LegislativeInfo>
<ns0:SessionYear>2025</ns0:SessionYear>
<ns0:SessionNum>0</ns0:SessionNum>
<ns0:MeasureType>AB</ns0:MeasureType>
<ns0:MeasureNum>2285</ns0:MeasureNum>
<ns0:MeasureState>AMD</ns0:MeasureState>
</ns0:LegislativeInfo>
<ns0:AuthorText authorType="LEAD_AUTHOR">Introduced by Assembly Member Valencia</ns0:AuthorText>
<ns0:Authors>
<ns0:Legislator>
<ns0:Contribution>LEAD_AUTHOR</ns0:Contribution>
<ns0:House>ASSEMBLY</ns0:House>
<ns0:Name>Valencia</ns0:Name>
</ns0:Legislator>
</ns0:Authors>
<ns0:Title> An act to add Division 1.26 (commencing with Section 3910) to the Financial Code, relating to financial regulation.</ns0:Title>
<ns0:RelatingClause>financial regulation</ns0:RelatingClause>
<ns0:GeneralSubject>
<ns0:Subject>Digital Financial Asset Banking Act.</ns0:Subject>
</ns0:GeneralSubject>
<ns0:DigestText>
<html:p>The Digital Financial Assets Law, on or after July 1, 2026, prohibits a person from engaging in digital financial asset business activity or holding itself out as being able to engage in digital financial asset business activity, with or on behalf of a resident unless any of specified conditions is true. The law defines “digital financial asset” to mean a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender, whether or not denominated in legal tender and defines “digital financial asset business activity”
to mean, among other similar things, exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.</html:p>
<html:p>This bill, the Digital Financial Asset Banking Act, would generally regulate a bank or a credit union under the examination authority of the Department of Financial Protection and Innovation with respect to its provision of digital asset custody services, staking services, and digital asset transaction services, as those terms are defined, including by requiring certain disclosures to costumers and requiring certain financial safety measures. The bill would require a
financial institution engaged in digital financial asset custody services to conduct an annual audit of its custodial activities and holdings that is either an independent audit or a review by the financial institution’s board of directors for accuracy and signed be each board member under penalty of perjury. By expanding the scope of the crime of perjury, this bill would impose a state-mandated local program.</html:p>
<html:p>This bill would authorize the department to enforce its provisions with administrative and civil remedies, as specified.</html:p>
<html:p>The California Constitution requires the state to reimburse local agencies and school districts for certain costs mandated by the state. Statutory provisions establish
procedures for making that reimbursement.</html:p>
<html:p>This bill would provide that no reimbursement is required by this act for a specified reason.</html:p>
</ns0:DigestText>
<ns0:DigestKey>
<ns0:VoteRequired>MAJORITY</ns0:VoteRequired>
<ns0:Appropriation>NO</ns0:Appropriation>
<ns0:FiscalCommittee>YES</ns0:FiscalCommittee>
<ns0:LocalProgram>YES</ns0:LocalProgram>
</ns0:DigestKey>
<ns0:MeasureIndicators>
<ns0:ImmediateEffect>NO</ns0:ImmediateEffect>
<ns0:ImmediateEffectFlags>
<ns0:Urgency>NO</ns0:Urgency>
<ns0:TaxLevy>NO</ns0:TaxLevy>
<ns0:Election>NO</ns0:Election>
<ns0:UsualCurrentExpenses>NO</ns0:UsualCurrentExpenses>
<ns0:BudgetBill>NO</ns0:BudgetBill>
<ns0:Prop25TrailerBill>NO</ns0:Prop25TrailerBill>
</ns0:ImmediateEffectFlags>
</ns0:MeasureIndicators>
</ns0:Description>
<ns0:Bill id="bill">
<ns0:Preamble>The people of the State of California do enact as follows:</ns0:Preamble>
<ns0:BillSection id="id_23240493-6A31-4D92-8CC1-08701BEA2764">
<ns0:Num>SECTION 1.</ns0:Num>
<ns0:ActionLine action="IS_ADDED" ns3:href="urn:caml:codes:FIN:caml#xpointer(%2Fcaml%3ALawDoc%2Fcaml%3ACode%2Fcaml%3ALawHeading%5B%40type%3D'DIVISION'%20and%20caml%3ANum%3D'1.26.'%5D)" ns3:label="fractionType: LAW_SPREAD||commencingWith: 3910" ns3:type="locator">
Division 1.26 (commencing with Section 3910) is added to the
<ns0:DocName>Financial Code</ns0:DocName>
, to read:
</ns0:ActionLine>
<ns0:Fragment>
<ns0:LawHeading id="id_04F1B703-3D10-42EB-B1AE-AF20298041A4" type="DIVISION">
<ns0:Num>1.26.</ns0:Num>
<ns0:LawHeadingVersion id="id_DC9DC2DC-D044-4222-B723-A999BD8134A0">
<ns0:LawHeadingText>Digital Financial Asset Banking Act</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawHeading id="id_BA0F7A3C-10B1-46D8-8C98-8307AF4DAE25" type="CHAPTER">
<ns0:Num>1.</ns0:Num>
<ns0:LawHeadingVersion id="id_3382E45C-D90C-424E-8515-9016F2989AD4">
<ns0:LawHeadingText>General provisions</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_48BC9382-AEBA-4282-AD49-4740B501A058">
<ns0:Num>3910.</ns0:Num>
<ns0:LawSectionVersion id="id_3189B538-0E0A-448E-8CD7-E752285639EF">
<ns0:Content>
<html:p>As used in this chapter:</html:p>
<html:p>
(a)
<html:span class="EnSpace"/>
“Active staking” means intentional participation in staking services resulting in inaccessibility to one’s digital financial asset for an agreed-upon time in exchange for a staking reward minus a fee that is in a fixed amount or a percentage of the staking reward.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
“Customer” means a person for whom a financial institution provides digital asset services, including a digital asset account holder or a person on whose behalf the financial institution acts in a fiduciary capacity.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
“Department” means the Department of Financial Protection and Innovation.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
“Digital asset” means a digital representation of value recorded on a cryptographically secured, distributed ledger or similar technology, including, but not limited to, a digital financial asset.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
“Digital asset custody services” means the safekeeping or custody of a digital financial asset on behalf of a customer by a financial institution, including maintaining control over the digital financial asset and any associated key.
</html:p>
<html:p>
(f)
<html:span class="EnSpace"/>
“Digital asset transaction services” means to facilitate the execution of a digital asset purchase or sale on behalf of a customer for compensation.
</html:p>
<html:p>
(g)
<html:span class="EnSpace"/>
“Digital financial asset” means a digital representation of value that is used as a medium of exchange, unit of account, or store of value, and that is not legal tender,
whether or not denominated in legal tender.
</html:p>
<html:p>
(h)
<html:span class="EnSpace"/>
“Digital financial asset business activity” means any of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
Exchanging, transferring, or storing a digital financial asset or engaging in digital financial asset administration, whether directly or through an agreement with a digital financial asset control services vendor.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Holding electronic precious metals or electronic certificates representing interests in precious metals on behalf of another person or issuing shares or electronic certificates representing interests in precious metals.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Exchanging one or more digital representations of value used within one or more online games, game platforms, or family of games for either of the following:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
A digital financial asset offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
Legal tender or bank or credit union credit outside of the online game, game platform, or family of games offered by, or on behalf of, the same publisher from which the original digital representation of value was received.
</html:p>
<html:p>
(i)
<html:span class="EnSpace"/>
“Digital wallet” means a digital interface or physical device that stores a digital asset or a private key in a manner that enables the owner to securely manage, transfer, and maintain independent control over the owner’s digital asset.
</html:p>
<html:p>
(j)
<html:span class="EnSpace"/>
“Fiduciary capacity” means a capacity in which a financial institution possesses investment, management, or administration discretion of a
digital financial asset on behalf of a customer that creates for the financial institution a strict duty to act in the best financial interest of the customer, including against its own interest.
</html:p>
<html:p>
(k)
<html:span class="EnSpace"/>
“Financial institution” means a bank or credit union operating under the examination authority of the department.
</html:p>
<html:p>
(l)
<html:span class="EnSpace"/>
“Key” means a pair of cryptographic codes associated with a digital asset wallet that consists of a public key and a private key that meets both of the following criteria:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The public key of the pair enables the receipt of a digital financial asset and the verification of a digital signature.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The private key of the pair enables the control, transfer, or management of a digital asset within the digital asset wallet.
</html:p>
<html:p>
(m)
<html:span class="EnSpace"/>
“Material cybersecurity incident” means a cybersecurity breach or event that materially compromises the security, confidentiality, or integrity of a financial institution’s information system or a digital asset under the financial institution’s control.
</html:p>
<html:p>
(n)
<html:span class="EnSpace"/>
“Nonfiduciary capacity” means providing digital asset custody services solely for safekeeping without discretionary authority to manage or transfer a digital financial asset and with respect to which legal title and control of the assets remain with the customer.
</html:p>
<html:p>
(o)
<html:span class="EnSpace"/>
“Passive staking” means staking pooled assets by, or on behalf of, the financial institution wherein the customer may receive the customer’s digital financial asset upon demand in exchange for a staking reward minus an agreed-upon fee, in a fixed amount or a percentage of the staking reward, from the
financial institution staking service provider.
</html:p>
<html:p>
(p)
<html:span class="EnSpace"/>
“Pooled custody” means the collective holding of fungible digital financial assets of like kind belonging to different customers in a shared account or digital asset wallet.
</html:p>
<html:p>
(q)
<html:span class="EnSpace"/>
“Segregated custody” means the holding separately from the digital financial assets of other customers of the fungible digital financial assets of an individual customer in an account or digital asset wallet.
</html:p>
<html:p>
(r)
<html:span class="EnSpace"/>
“Slashing” means a penalty imposed by a blockchain protocol that results in the forfeiture or reduction of staked digital assets or staking rewards due to validator misconduct or failure.
</html:p>
<html:p>
(s)
<html:span class="EnSpace"/>
“Staking” means committing fungible digital financial assets to a blockchain network to participate in the network’s operations
by validating transactions, proposing and attesting to blocks, and securing the network.
</html:p>
<html:p>
(t)
<html:span class="EnSpace"/>
“Staking reward” means any interest, yield, or other compensation earned by a customer from staking a digital financial asset on a blockchain network.
</html:p>
<html:p>
(u)
<html:span class="EnSpace"/>
“Subcustodian” means a third party that a financial institution uses to hold a digital financial asset on the financial institution’s behalf as part of providing digital asset custody services to a customer.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_1440CFBB-CE33-4224-937F-7DC44EB656CA" type="CHAPTER">
<ns0:Num>2.</ns0:Num>
<ns0:LawHeadingVersion id="id_94C261A6-9FBE-4C28-B3D5-5418A4B40240">
<ns0:LawHeadingText>Digital Asset Custody Services</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_98B6B50C-B780-476F-BBED-9B49C48F8D56">
<ns0:Num>3915.</ns0:Num>
<ns0:LawSectionVersion id="id_FBF70897-AAB7-49AE-82A1-B85ED48AB3B9">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution that provides digital asset custody services in a nonfiduciary capacity shall act only upon the explicit instructions of the customer and shall not independently manage, transfer, or dispose of the digital financial assets.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution shall enter into a written custodial agreement with each customer before undertaking digital asset custody services that meets all of the following conditions:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The custodial agreement clearly specifies whether the financial institution is acting in a fiduciary capacity or a nonfiduciary capacity for that customer.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The custodial
agreement includes both of the following prominent, written disclosures:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
Whether or not a digital financial asset held in custody by the financial institution is insured by the Federal Deposit Insurance Corporation, the National Credit Union Administration, or any other federal or state deposit insurance or share insurance program.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
Whether or not a digital financial asset held in custody by the financial institution is a deposit, obligation, or other liability of the financial institution.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
The custodial agreement contains the terms of service for digital asset management, investment, or otherwise control and inconspicuously describes thresholds or other triggering events that may cause the financial institution to take action on the customer’s behalf.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
Any change or update to the custodial agreement shall be provided to the customer no less than 45 days before it becomes effective.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_C82AE262-8389-4686-A16C-69964424A783">
<ns0:Num>3916.</ns0:Num>
<ns0:LawSectionVersion id="id_F3487214-FABF-4724-82D8-F85942EEBBF6">
<ns0:Content>
<html:p>A financial institution shall not hold less than a one-to-one full reserve of each digital asset owed or attributable to its passive staking customers, and the financial institution’s aggregate holdings of each such digital asset shall, at all times, be greater than the total amount of deposited assets.</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_73FAAA22-EC81-400C-9BA4-946E807CE919">
<ns0:Num>3917.</ns0:Num>
<ns0:LawSectionVersion id="id_03EFB1A4-2410-47AF-B4B5-CAFC534949DE">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution shall not hold digital financial assets in a pooled custody arrangement or segregate digital financial assets by individual customer pursuant to a custodial agreement unless the financial institution maintains accurate records identifying each customer’s specific interest in the digital financial assets.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
Pooled custody of assets, as described in subdivision (a), shall not relieve the financial institution of the requirement to individually account for and fully reserve each type of digital asset for the benefit of customers under Section 3916.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_0D6A7A81-A851-480E-9384-1E355293F369">
<ns0:Num>3918.</ns0:Num>
<ns0:LawSectionVersion id="id_72C50B92-F297-45F9-B329-F2E3853C620B">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution engaged in digital financial asset custody services shall conduct an annual audit of its custodial activities and holdings that is either of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
An independent audit.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A review by the financial institution’s board of directors for accuracy and signed by each board member under penalty of perjury.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
The audit conducted under this section shall contain all of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
A review for any violation of Section 3916.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A review for
any violation of Section 3917.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
A review for a violation of Section 3929.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_2F22F065-FF03-4FDF-A6CE-B2CBD80F8326" type="CHAPTER">
<ns0:Num>3.</ns0:Num>
<ns0:LawHeadingVersion id="id_E0DA5D65-ED9A-49C5-BB85-7D73A237FF11">
<ns0:LawHeadingText>Subcustody of Digital Assets</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_44A38CC9-9BF4-4793-8C29-17478909938A">
<ns0:Num>3920.</ns0:Num>
<ns0:LawSectionVersion id="id_D4CA2438-4C33-4A78-8CA9-B659B1051290">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution shall not utilize a subcustodian to assist in providing digital asset custody services to its customers unless the use of a subcustodian is prominently disclosed on the first page of the customer’s custodial agreement.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution that utilizes a subcustodian shall ensure the compliance of its subcustodian with this division.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution shall not place a digital financial asset into subcustody unless the subcustodian meets all of the following criteria:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The subcustodian maintains insurance coverage sufficient to protect against the loss of digital
financial assets due to cybersecurity breaches, theft, or other similar events.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The subcustodian is any of the following:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
A bank chartered or licensed under the laws of this state, another state, or the United States.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
A special purpose depository financial institution chartered or licensed under the laws of this or another state.
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
A digital asset company licensed as a digital financial asset business pursuant to Division 1.25 (commencing with Section 3101) or a money transmitter licensed pursuant to Division 1.2 (commencing with Section 2000).
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
A financial institution shall document in a written subcustodial agreement any subcustodial arrangement
and shall structure the arrangement so that the financial institution remains the custodial recordholder of the digital financial assets on behalf of its customers, and the digital financial assets remain the property of the financial institution’s customers.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The financial institution shall make any subcustodial agreement described in this subdivision available to the department upon request.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
A financial institution shall ensure that a subcustodian’s insurance remains in effect and adequate to cover the value of digital financial assets held in subcustody.
</html:p>
<html:p>
(f)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
A subcustodian shall not commingle different types of digital financial assets for reserve purposes.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A subcustodian shall not commingle the assets of
different financial institutions.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_C5777805-D2FB-4345-956F-3263F8FFB684">
<ns0:Num>3921.</ns0:Num>
<ns0:LawSectionVersion id="id_8F23E7B3-B6C1-443E-8556-B7BF32CA9EE7">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A record relating to digital financial assets held in subcustody shall be subject to examination by the department to the same extent as a record relating to digital financial assets held directly by the financial institution.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
A subcustodian has the fiduciary duties to the customer imposed on the financial institution.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
(A)
<html:span class="EnSpace"/>
A claim for breach of fiduciary duty by a customer shall be brought only against a financial institution.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
This paragraph does not affect an indemnification provision in a subcustodial
agreement.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_DE6C2D2A-8EFC-42D2-9F98-13AA6BB41488" type="CHAPTER">
<ns0:Num>4.</ns0:Num>
<ns0:LawHeadingVersion id="id_1D718306-8A9A-4989-B48D-50D7FB24ED19">
<ns0:LawHeadingText>Staking Services</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_54197B33-9668-49BE-8A2F-B6345F7F04D9">
<ns0:Num>3925.</ns0:Num>
<ns0:LawSectionVersion id="id_66E94488-D4DE-45DC-BA62-D48AF6EA29B2">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution shall not use a third party for staking services unless all of the following criteria are met:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The third party is a subcustodian or a digital financial asset company.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The financial institution maintains legal control over the staked assets and maintains appropriate oversight of the staking service.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
The arrangement for staking services is governed by a written agreement that describes the rights and responsibilities of the financial institution and the subcustodian or digital financial asset company and requires compliance with this chapter.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution that uses a subcustodian or digital financial asset company for staking services shall remain responsible for ensuring compliance with all requirements of this chapter.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_3D4C94A5-5C56-4069-B6F0-86AE91D4DC21">
<ns0:Num>3926.</ns0:Num>
<ns0:LawSectionVersion id="id_32C95710-806F-4140-8CED-A3129FC102FC">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution that stakes a digital financial asset on behalf of a customer shall maintain a reserve of each digital financial asset in an amount sufficient to facilitate a timely customer withdrawal or transfer.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution shall ensure that an appropriate portion of each digital financial asset type remains available to meet a passive staking customer request upon demand and an active staking customer request upon demand subject to any staking lockup or unbonding period disclosed to the customer pursuant to this division.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_C2EE51CB-D32A-4EAD-A5D3-5CE7DB70B574">
<ns0:Num>3927.</ns0:Num>
<ns0:LawSectionVersion id="id_5BEE960E-4FFD-4360-B968-86A2476EACE3">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A staking reward shall accrue to the benefit of the customer to whom the relevant digital financial asset belongs.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution shall not deduct a fee or commission from staking rewards unless that fee or commission has been disclosed to the customer in writing before beginning staking services and is either of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
For a staking reward that is greater than one hundred dollars ($100), not more than five dollars ($5).
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
For a staking reward that is greater than one hundred dollars ($100), not more than 5 percent of the total amount of the staking reward.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution shall not charge a fee to cover any nonprovable startup costs to provide active staking unless the financial institution provides to the customer an itemized receipt.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
Except as otherwise agreed to in writing by the customer, a financial institution shall pay any staking reward earned from staking services to the customer by crediting the customer’s account in the same type of digital financial asset that was used to provide staking services.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A payment made under this subdivision shall be made within two business days after the staking rewards are received or become available to the financial institution or third party used to provide staking services.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_B2E2956F-C9F8-4E0C-8978-10955A66300B">
<ns0:Num>3928.</ns0:Num>
<ns0:LawSectionVersion id="id_57EA73E1-CC2E-41EB-A617-3023F4B6CEFA">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A digital financial asset that a financial institution stakes on behalf of a customer shall remain the property of that customer, and a financial institution shall not record as an asset or liability of the financial institution a staked customer digital financial asset or any staking reward associated with that digital financial asset.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A financial institution shall safeguard any staked digital financial asset and not subject it to any lien, security interest, or claim of a creditor of the financial institution.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution shall not encumber, hypothecate, or otherwise use a customer’s staked digital financial asset for any purpose except to facilitate
staking services on the relevant blockchain or distributed ledger and shall not expose that digital financial asset to risk of loss except to the extent required in the normal operation of the staking process.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
A financial institution shall implement and maintain written internal policies and procedures to effectively identify, monitor, and manage risks associated with staking, including operational risks, cybersecurity threats, and slashing.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
A financial institution shall maintain insurance coverage adequate to protect against potential losses arising from staking activities, including losses attributable to slashing, cybersecurity breaches, theft, or similar events, and shall ensure that insurance coverage remains in effect and sufficient to cover the current value of assets staked on behalf of customers.
</html:p>
<html:p>
(f)
<html:span class="EnSpace"/>
Any record related to the financial institution’s staking services shall be available for independent audit and examination by the commissioner in the same manner as a record of a nonstaked custodial asset.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_0AA90A35-327B-4DBC-8E46-452107E787DA">
<ns0:Num>3929.</ns0:Num>
<ns0:LawSectionVersion id="id_EA3AD1A7-A243-4BF2-9AD5-67B317AB1D57">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
Before initiating staking services for a customer’s digital financial assets, a financial institution shall provide the customer with a clear and conspicuous written disclosure, in plain language and presented in a manner that is readily accessible and understandable to the customer, of the terms and conditions of the staking services that includes, at a minimum, information regarding all of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The fact that the financial institution may automatically stake an eligible digital financial asset in the customer’s account unless the customer affirmatively opts out of participation.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The key risks associated with staking, including the potential for loss of
staked assets or staking rewards due to slashing or other network events, and cybersecurity or operational risks inherent in the staking process.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Any applicable lockup, unbonding, or notice period before a staked digital financial asset can be withdrawn or transferred and the implications of that period for the customer’s access to the customer’s digital financial assets.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
The customer’s rights and obligations related to the staking service, including the right to discontinue participation in staking at any time and the entitlement to receive staking rewards earned on the customer’s digital financial assets.
</html:p>
<html:p>
(5)
<html:span class="EnSpace"/>
The amount or rate of any fee or commission that the financial institution will deduct from a staking reward as compensation for providing staking services.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A customer’s agreement to participate in the staking services shall constitute authorization for the financial institution to stake the customer’s digital financial assets on a passive basis in accordance with this section.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution shall not provide active staking services to a customer unless the customer provides an affirmative agreement to participate in active staking services.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_EC0963A2-FC4E-4739-8252-5F1F18FF1CB4" type="CHAPTER">
<ns0:Num>5.</ns0:Num>
<ns0:LawHeadingVersion id="id_E00DF24F-A4F6-454F-83C8-ED5782A0CEA1">
<ns0:LawHeadingText>Money Laundering and Cybersecurity</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_2E558599-E692-40F8-860E-26DE2EAE972B">
<ns0:Num>3935.</ns0:Num>
<ns0:LawSectionVersion id="id_68FCEC10-A134-4734-9578-66495CB9527D">
<ns0:Content>
<html:p>A financial institution shall establish and maintain an antimoney laundering compliance program that is risk based and commensurate with the nature and scope of the financial institution’s digital asset custody and staking services that includes, but is not limited to, all of the following:</html:p>
<html:p>
(a)
<html:span class="EnSpace"/>
A system of internal controls to ensure ongoing compliance with the Bank Secrecy Act (31 U.S.C. Section 5311 et seq.) and other applicable antimoney laundering law.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
Independent testing for compliance to be conducted by qualified internal audit personnel or an independent external party.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
The designation of an officer responsible for
coordinating compliance with the Bank Secrecy Act (31 U.S.C. Section 5311 et seq.) and the financial institution’s antimoney laundering program.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
Appropriate risk-based procedures for conducting ongoing customer due diligence, including monitoring of customer transactions and updating customer information as necessary.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_359AF04D-5794-4BDA-8196-464781150245">
<ns0:Num>3936.</ns0:Num>
<ns0:LawSectionVersion id="id_897A1D5E-98EA-4FA9-BC62-F28147522C47">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution and any of its subcustodians shall maintain a cybersecurity program designed to protect the confidentiality, integrity, and availability of the financial institution’s information systems, digital asset custody, and staking software and hardware that is based on the financial institution’s risk assessment and designed to perform all of the following functions:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
Identifying and assessing internal and external cybersecurity risks that threaten the security or integrity of nonpublic information stored on the financial institution’s information systems as it relates to the digital financial assets of its customers.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Using defensive infrastructure
and the implementation of policies and procedures to protect the financial institution’s information systems, and the nonpublic information stored on those information systems, from unauthorized access, use, or other malicious acts.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
Detecting cybersecurity events.
</html:p>
<html:p>
(4)
<html:span class="EnSpace"/>
Responding to identified or detected cybersecurity events to mitigate any negative effects.
</html:p>
<html:p>
(5)
<html:span class="EnSpace"/>
Recovering from cybersecurity events and restoring normal operations and services.
</html:p>
<html:p>
(6)
<html:span class="EnSpace"/>
Fulfilling applicable regulatory reporting obligations.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
Any information relevant to the financial institution’s cybersecurity program, including the relevant and applicable provisions of a cybersecurity program maintained by any
subcustodian, shall be made available to the department upon request.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
The cybersecurity program for a financial institution and any of its subcustodians shall align with applicable federal cybersecurity standards for financial institutions, including, but not limited to, the guidelines of the Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbook, the framework established by the National Institute of Standards and Technology (NIST), and any other standard deemed applicable by the department and shall comply with applicable federal financial privacy and data security requirements, as determined by the department.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
A financial institution shall notify the department within 72 hours after discovering any material cybersecurity incident that impacts the financial institution or its subcustodian’s digital
asset custody or staking software or hardware or any digital financial asset held or managed through those systems.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
The notice required by this subdivision shall include a description of the incident and its likely impact on the financial institution and its customers, as prescribed by the department.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
A financial institution shall maintain, for at least seven years, detailed records of its compliance efforts under this section, including any policy, procedure, risk assessment, audit report, or training material related to its antimoney laundering program and cybersecurity program, and shall make those records available for inspection by the department upon request or during any examination.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_DC4DDBF7-2B17-4577-A84D-5A76A3A9E1CD" type="CHAPTER">
<ns0:Num>6.</ns0:Num>
<ns0:LawHeadingVersion id="id_068937FE-2EC9-4730-B0CC-2D3635C0BE66">
<ns0:LawHeadingText>Fiduciary Digital Asset Transaction Authority</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_A5202C33-4C86-4FC8-8490-9CD7F8DD0D25">
<ns0:Num>3940.</ns0:Num>
<ns0:LawSectionVersion id="id_D22970FD-DA8F-4A64-AACD-CBE843674A83">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
A financial institution shall not facilitate the purchase or sale of digital financial assets on behalf of a fiduciary account or customer unless the financial institution is acting in a fiduciary capacity pursuant to the express instruction of the customer.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
Any fiduciary activity conducted through or with a subcustodian shall be conducted only through or with a subcustodian that is duly licensed or chartered to conduct digital asset business activity.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution that facilitates a digital financial asset transaction on behalf of a fiduciary account or customer shall act solely in a fiduciary capacity for the benefit of its customer and shall not
engage in proprietary trading of a digital financial asset.
</html:p>
<html:p>
(d)
<html:span class="EnSpace"/>
A financial institution that facilitates a digital financial asset transaction on behalf of a fiduciary account or customer may utilize subcustodians to execute transactions on behalf of fiduciary accounts. The financial institution may delegate discretionary authority to these subcustodians regarding the timing, sequence, and venue of transaction execution. Such delegation shall comply with the fiduciary responsibilities of the financial institution and be subject to ongoing oversight. The financial institution shall perform due diligence and maintain continuous monitoring of any subcustodian to ensure compliance with this division and the protection of fiduciary assets. Delegation of authority under this subdivision does not relieve the financial institution of its fiduciary obligations or its ultimate responsibility for compliance with the requirements of this division.
</html:p>
<html:p>
(e)
<html:span class="EnSpace"/>
A financial institution that purchases a digital financial asset on behalf of a fiduciary account or customer shall ensure that the digital financial asset is transferred into the financial institution’s custody as soon as reasonably practicable after execution of the transaction is held in custody pursuant to this division and maintained under the financial institution’s control consistent with its fiduciary obligations.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_179ECCED-B387-4721-88D9-7CABB2B39A20">
<ns0:Num>3941.</ns0:Num>
<ns0:LawSectionVersion id="id_A692E49D-D933-48A2-8F9D-E197FA9FA9E4">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
Before a financial institution facilitates the purchase or sale of digital financial assets on behalf of a fiduciary account or customer, the financial institution shall disclose, in a clear and conspicuous written form, to the person on whose behalf it acts all of the following:
</html:p>
<html:p>
(1)
<html:span class="EnSpace"/>
The methodology or basis used to determine the execution price of the digital financial asset transaction.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
Any spread, fee, commission, or other charge that will be applied to the transaction.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
The expected timeline for settlement of the transaction and for the digital financial asset to be available in the customer’s
fiduciary account.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
(1)
<html:span class="EnSpace"/>
For any digital financial asset purchase or sale executed on behalf of a fiduciary account or customer, the financial institution shall create and retain an electronic record of the transaction, including, but not limited to, all of the following:
</html:p>
<html:p>
(A)
<html:span class="EnSpace"/>
The date and time of execution.
</html:p>
<html:p>
(B)
<html:span class="EnSpace"/>
The type and amount of digital financial asset purchased or sold.
</html:p>
<html:p>
(C)
<html:span class="EnSpace"/>
The price at which the transaction was executed.
</html:p>
<html:p>
(D)
<html:span class="EnSpace"/>
The identity of the custodian used.
</html:p>
<html:p>
(E)
<html:span class="EnSpace"/>
Any fee, commission, or spread charged.
</html:p>
<html:p>
(2)
<html:span class="EnSpace"/>
A record described in
this subdivision shall be maintained for at least seven years and contain information to assess compliance with Section 3920.
</html:p>
<html:p>
(3)
<html:span class="EnSpace"/>
A record described in this subdivision shall be made available to the department upon request or during examination.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_19B9F71B-CF44-483C-9EC2-B9808D78F45B">
<ns0:Num>3942.</ns0:Num>
<ns0:LawSectionVersion id="id_7FF0ED82-39AA-4834-9DEF-32DCB79701F0">
<ns0:Content>
<html:p>A financial institution shall document its compliance with this chapter and shall be prepared to demonstrate that compliance to the department.</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
<ns0:LawHeading id="id_06603FCF-7F77-4ADE-8722-051D3A29BF69" type="CHAPTER">
<ns0:Num>7.</ns0:Num>
<ns0:LawHeadingVersion id="id_1358D54F-2AD6-46F8-A102-2E98DFC2F0A3">
<ns0:LawHeadingText>Enforcement</ns0:LawHeadingText>
</ns0:LawHeadingVersion>
<ns0:LawSection id="id_F81864D1-52E4-4289-B5B1-6C6D8A1FC732">
<ns0:Num>3945.</ns0:Num>
<ns0:LawSectionVersion id="id_AAA66188-2911-4D18-9390-0D42117EE957">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
The department may issue a written order directing a financial institution to take specific corrective action to remedy any violation of this division that states the grounds for issuance and the required remedial measures.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
The financial institution shall, within 10 calendar days of receiving an order authorized by subdivision (a), respond in writing to the department detailing the corrective actions taken or planned to address the issues identified.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_A74ABDFD-2518-41E1-8206-C210F1B47305">
<ns0:Num>3946.</ns0:Num>
<ns0:LawSectionVersion id="id_76644191-281A-4E5E-A816-B4856938BCE5">
<ns0:Content>
<html:p>If the department believes that a financial institution is engaged in an unfair or deceptive practice with respect to conduct subject to this division, the department may serve upon the financial institution a written notice describing the alleged violation or practice and specifying a time and place for a hearing to be held within 15 calendar days of the notice, at which the financial institution may present evidence or argument. If, after that notice and hearing, the department finds that the financial institution has engaged in the alleged conduct, the department may issue a cease and desist order ordering the financial institution to immediately discontinue the specified conduct and to take affirmative action, if necessary, to prevent its recurrence.</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_2BEF7EDA-88CF-46B6-8316-F8C071C6AE78">
<ns0:Num>3947.</ns0:Num>
<ns0:LawSectionVersion id="id_F28117F9-5E6F-4978-B3B5-3D9ADB2BFC49">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
If the department finds that a financial institution’s conduct or condition is likely to cause immediate and irreparable harm to its customers or the public before a formal hearing can be concluded pursuant to Section 3946, the department shall issue a temporary emergency order that directs the financial institution to immediately cease or desist from a specified activity or to take any other action necessary to prevent or mitigate the harm.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
An order under this section is effective upon service on the financial institution.
</html:p>
<html:p>
(c)
<html:span class="EnSpace"/>
A financial institution subject to an order under this section shall be given the opportunity for an expedited hearing. Upon the financial
institution’s request, a hearing shall be held within 10 calendar days after the issuance of the order to determine whether the order should be stayed, modified, or made permanent. If the financial institution does not request a hearing within the 10-day period, or if the financial institution fails to appear at the scheduled hearing, the temporary order shall remain in effect until the department either lifts it or replaces it with a cease and desist order or other final order under this chapter.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_F1E26DAC-A943-440C-8E78-05DA6DB07590">
<ns0:Num>3948.</ns0:Num>
<ns0:LawSectionVersion id="id_1CF3C51D-9AD7-4CA4-9BB3-01F74220088C">
<ns0:Content>
<html:p>The department may impose a civil penalty for a violation of this division subject to all of the following:</html:p>
<html:p>
(a)
<html:span class="EnSpace"/>
For a first violation, the civil penalty shall not exceed five thousand dollars ($5,000) per violation.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
For any subsequent offense, the civil penalty shall not exceed ten thousand dollars ($10,000) per violation.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
<ns0:LawSection id="id_600B2551-71DE-43B5-AB59-0ECB5A241511">
<ns0:Num>3949.</ns0:Num>
<ns0:LawSectionVersion id="id_911BE1D8-1443-418F-8659-B639D2F83936">
<ns0:Content>
<html:p>
(a)
<html:span class="EnSpace"/>
If the department finds that a financial institution has committed a material or repeated violation of this division, has willfully defied any lawful order issued by the department under this division, or is conducting its digital financial asset business activity in a manner that poses a significant risk to the safety of customer assets or to the soundness of the financial institution, the department may suspend or revoke the financial institution’s authority to provide any digital asset service subject to this division.
</html:p>
<html:p>
(b)
<html:span class="EnSpace"/>
A suspension or revocation issued under this section shall become effective only after the financial institution has been given notice, a hearing opportunity, and a written decision by the department affirming the
grounds for the action.
</html:p>
</ns0:Content>
</ns0:LawSectionVersion>
</ns0:LawSection>
</ns0:LawHeading>
</ns0:LawHeading>
</ns0:Fragment>
</ns0:BillSection>
<ns0:BillSection id="id_BA0F2DBD-CF2E-41E1-A2B5-21742DB87CB2">
<ns0:Num>SEC. 2.</ns0:Num>
<ns0:Content>
<html:p>
No reimbursement is required by this act pursuant to Section 6 of Article XIII
<html:span class="ThinSpace"/>
B of the California Constitution because the only costs that may be incurred by a local agency or school district will be incurred because this act creates a new crime or infraction, eliminates a crime or infraction, or changes the penalty for a crime or infraction, within the meaning of Section 17556 of the Government Code, or changes the definition of a crime within the meaning of Section 6 of Article XIII
<html:span class="ThinSpace"/>
B of the California Constitution.
</html:p>
</ns0:Content>
</ns0:BillSection>
</ns0:Bill>
</ns0:MeasureDoc>