Six standards, one licensing decision
DFPI’s public summaries describe six licensing standards applicants must satisfy — themes spanning financial condition, competence, experience, fitness, compliance with key statutory chapters, and a reasonable basis to believe the business will operate lawfully if licensed. Think of them as overlapping lenses, not six independent quizzes you can pass on technicalities.
Reviewers are asking whether California residents will be safe if your firm scales. That question connects capital, people, and programs. A brilliant AML policy cannot compensate for insolvent operations; strong treasury cannot compensate for unfit control persons.
Educational content only — not legal advice. Anchor internal assessments to DFPI’s Digital Financial Assets licensing materials and counsel-reviewed facts.
When you brief investors or hires, describe the six standards as the regulator’s checklist for sustainable operations — not as bureaucratic poetry. That framing helps product and engineering prioritize controls that licensing actually tests.
Sound financial condition in operational metrics
Financial condition is more than a balance sheet snapshot. It includes whether you can absorb volatility in digital asset markets, maintain required capital and bonding postures as rules finalize, and continue operating through stress without freezing customer withdrawals inappropriately.
Prepare trailing financials, projections with explicit assumptions, and liquidity policies that show who approves treasury movements. Document how you handle related-party transactions and intercompany flows — common in crypto groups where brand and license entity differ.
Boards should see a monthly “financial integrity” dashboard tied to licensing narratives, not only GAAP reporting.
Include scenario analysis for asset price shocks, partner insolvency, and bank or custodian outages. Quantified scenarios read better than narrative hand-waving about “strong reserves.”
Competence and experience: proving you can run the model
Competence and experience standards expect leadership and key personnel to understand the business model and regulatory environment. For novel products, show hiring profiles, training plans, and external advisors with clear mandates — not vague consultant names in a slide.
Map executives and responsible individuals to program ownership: BSA, cybersecurity, custody, customer support, and finance. Gaps are acceptable if you show credible fill plans with dates before launch at scale.
Capture industry credentials, prior examinations, and remediation history transparently. Surprises discovered via background review are worse than disclosed issues with remediation stories.
Include training completion logs for customer-facing staff on fraud red flags and complaint escalation — competence extends beyond the C-suite.
Cross-standard evidence pack
Bundle sample evidence that satisfies multiple standards at once: a tabletop exercise report shows governance (lawful operation), incident handling (compliance chapters), and management engagement (fitness). Efficient packs reduce NMLS attachment sprawl.
Index the pack in your cover memo so DFPI reviewers can navigate without a scavenger hunt.
Refresh the pack when rulemaking or product scope changes materially.
Fitness and executive officer scrutiny
Fitness themes cover honesty, integrity, and regulatory history for executive officers, responsible individuals, and control persons. NMLS MU2 attestations and background reviews are part of the picture; so are civil litigation, regulatory actions, and bankruptcy histories that must be explained coherently.
Corporate governance matters: active boards, documented conflicts policies, and evidence that executives cannot unilaterally bypass compliance. If founders retain extraordinary voting rights, show how compliance can still escalate issues to the board without retaliation.
Run internal fitness pre-checks before you list someone on MU2 — parallel to how banks screen officer candidates.
Compliance with DFAL chapters as a living program
Applicants must demonstrate compliance capacity across DFAL’s operative chapters — consumer protection, custody and exchange rules as applicable, cybersecurity expectations, and other obligations tied to the applicant’s model. This is where policies must match operations: sample transaction monitoring alerts, incident tickets, reconciliation logs, and complaint resolutions.
Do not upload template packs unchanged. Mark them up with your entities, thresholds, escalation paths, and California-specific references. Examiners recognize boilerplate.
Program testing beats program writing: show quarterly tests, findings, and fixes.
Reasonable basis to operate lawfully if licensed
The sixth standard is the synthesis: given everything DFPI knows, is it reasonable to believe you will operate in compliance if licensed? Narrative coherence wins. If you claim conservative risk appetite but marketing promises high yield, reviewers notice.
Tie the story to metrics and ownership. Who reads SAR metrics? Who signs off on penetration test remediations? Who approves new assets listed? Name names and meeting cadences.
Operators preparing with CompliFi often map each licensing standard to statutory rows and vault evidence — so when standards update through rulemaking, the firm’s control library updates instead of spawning a shadow folder structure.
Executive officers and responsible individuals: alignment tips
Titles on LinkedIn should not surprise NMLS. Align employment agreements, org charts, MU2 listings, and who actually signs regulatory filings. If your Chief Compliance Officer is also General Counsel without bandwidth, say how coverage works — do not pretend dual hats are invisible.
Document delegation carefully. DFPI needs to know who is accountable, not only who is busy.
Plan for turnover: acting officer appointments, board notifications, and interim authority limits should be pre-drafted.
DFPI resources on standards
DFPI’s application preparation materials translate standards into document requests and interview themes. Re-read them after major product changes — standards are stable in headline form but detailed expectations evolve through rulemaking.
Use the Digital Financial Assets hub at https://dfpi.ca.gov/regulated-industries/digital-financial-assets/ as the canonical source for how DFPI explains standards to the public.
When standards overlap federal expectations, show California incremental controls explicitly — do not assume reviewers will infer them.
Interview and examination mindset
Standards show up again after licensing in supervision. Train executives and responsible individuals to answer in terms of outcomes and metrics, not slogans. If asked about financial condition, cite liquidity policy limits and who breached them last — and what changed afterward.
Record mock interviews quarterly. Video is optional; written Q&A logs with remediation owners are enough to prove you rehearsed.
Fitness issues for new hires should trigger the same pre-clearance workflow before they appear on org charts customers see.
What to do this week
Score your firm against each of the six standards using a simple 1–5 maturity rubric. Anything below 3 gets a remediation project with executive sponsor, budget, and target date before you claim application readiness.
Schedule MU2 alignment sessions: confirm every listed responsible individual can explain your California program in their own words, without reading slides verbatim.
Want standards mapped to evidence you can export for NMLS? Join the CompliFi waitlist at https://complifi.co/waitlist — note “licensing standards” in your signup so onboarding can prioritize fitness and financial condition workflows.