United States — California (US-CA)

Licensing, Authorisation & Market Access

California is the canonical US federalised payments case for market access. California has no single EMI/PI regime; non-bank payment-firm market access runs through the state Money Transmission Act (Cal. Fin. Code Div. 1.2, §2000 et seq.), administered by the DFPI via NMLS, layered on FinCEN MSB registration. This is the defining structural feature for any non-bank PI/EMI seeking California market access: there is no consolidated payments licence equivalent to a European authorisation, but rather a state money-transmission regime sitting beneath a federal registration requirement. The new-licence filing fee is $5,000 non-refundable, surety bond ranges run $250k–$7m, and a net-worth sliding scale sets entry economics; crypto applicants are directed to the DFPI Crypto Unit.

The modernisation of this regime is the key delta. AB-1116, signed 8 October 2023, amended the MTA effective 1 January 2024 to align with the Model Money Transmission Modernization Act, adopting a tangible-net-worth sliding scale (greater of $100,000 or 3% of total assets to $100m, 2% from $100m–$1bn, 0.5% above $1bn), with transition to 1 January 2025. This Model-Law alignment harmonises California with the multistate prudential approach, reducing some of the divergence cost for firms operating across several states while preserving the state-by-state licensing burden. The bank-PSP versus non-bank-PI/EMI distinction is sharp here: the MTA route applies to non-bank money transmitters, whereas chartered banks access the market through their banking authorisation rather than the transmitter regime.

A live ambiguity remains in the interaction between the MTA and the digital-financial-asset licensing layer. Proposed regulations would clarify, but not automatically resolve, whether crypto activity requiring a DFAL licence also triggers MTA licensing — a licensing-overlap question of real consequence for California digital-money firms, which may face dual authorisation pathways pending regulatory clarification.

Outlook

The MTA/DFPI route is an established standing position, and AB-1116's Model-Law modernisation is now in force. The forward watch item is resolution of the DFAL-MTA boundary, which proposed regulations are expected to address but not fully settle, leaving non-bank digital-money firms to plan for potential overlapping licensing obligations into the second half of 2026.

Stablecoins & Digital Money

California's digital-money regime is the escalating centre of gravity this cycle. DFAL, signed 13 October 2023 (Cal. Fin. Code §3101 et seq.), gives the DFPI authority to license, supervise and examine digital-financial-asset businesses, custodians and stablecoin issuers; AB 1934 extended the core licensing date from 1 July 2025 to 1 July 2026, and applications are now open via NMLS. This is a BitLicense-style regime, and its interaction with the MTA is to be clarified — not automatically resolved — by proposed regulations.

The reserve and eligible-issuer constraints are the substantive core for stablecoin transacting. DFAL bars licensees from transacting in a stablecoin unless the issuer is a DFAL applicant/licensee or a bank/trust company authorised for trust banking, and the issuer at all times owns eligible securities with aggregate market value not less than all outstanding stablecoins; issuers may not represent the stablecoin is as safe as a bank credit or stored-value product. Reserve backing is constrained to MTA-listed eligible securities, and covered exchanges must self-certify a risk assessment before listing.

The federal layer sits above California DFAL, and its timeline was corrected this cycle. The federal GENIUS Act was enacted 18 July 2025; its effective date is the earlier of 18 months after enactment (18 January 2027) or 120 days after the primary federal payment-stablecoin regulators issue final regulations. As of June 2026 OCC, FDIC and Treasury have issued proposed rules (NPRMs) but final rules are not yet adopted; there is no statutory July 2026 deadline for final regulations. This correction matters operationally: firms should not plan against a July 2026 federal final-rule date, because none exists in statute. The binding near-term cliff is the California 1 July 2026 licensing deadline, which precedes any plausible federal effective date. Both bank and non-bank entities are in scope of DFAL and the federal framework, though the eligible-issuer rule privileges banks and trust companies authorised for trust banking as permitted stablecoin issuers.

Outlook

The trajectory is escalating. The California DFAL deadline (1 July 2026) is a hard, near-term horizon with applications open; the federal GENIUS Act effective date is governed by the formula of earliest of 18 January 2027 or 120 days post-final-rules, with federal rules at NPRM stage. The residual uncertainty is federal final-regulation timing, which cannot be pinned beyond the statutory formula, and the unresolved DFAL-MTA licensing overlap.

Correspondent Banking, Settlement & Access

The analytical spine of this module is the bank versus non-bank access asymmetry to central-bank settlement — and that asymmetry is under active reconstruction. The proposed Payment Account (proposed 20 May 2026, comments due 27 July 2026) would let fintechs and nonbanks settle directly on Fedwire, FedNow and NSS (but not FedACH), with no discount-window access, no intraday credit and closing-balance limits capped at $1bn; it is barred from correspondent banking activity and from settling on behalf of third parties — a deliberate risk-limiting constraint distinct from full Master Accounts. The design is significant: it narrows but does not eliminate the asymmetry, granting non-bank PI/EMI firms direct settlement access while withholding the credit and correspondent functions reserved to full Master Account holders. Multiple commenters noted that direct access would reduce counterparty risk and could displace traditional correspondent relationships.

The access pathway for novel institutions is meanwhile partly paused. Under the 2022 Account Access Guidelines' three-tier framework, the Board is urging Reserve Banks to pause decisions on Tier 2/Tier 3 access requests until its policy-development process completes, with the pause expected to end on or before 31 December 2026. In March 2026 the Kansas City Fed approved a limited-purpose account for Kraken Financial with no intraday credit or discount-window access and an end-of-day balance limit — a template for restricted settlement access pending policy completion. For non-bank firms, the practical position is a partial freeze on full-tier access decisions, mitigated by limited-purpose templates such as the Kraken Financial approval.

Outlook

The trajectory is escalating. The Payment Account comment deadline (27 July 2026) and the Tier 2/3 access pause expected to lift on or before 31 December 2026 are the forward markers. The structural direction is toward a narrowing of the bank/non-bank settlement asymmetry, with the potential to reduce non-bank reliance on correspondent and sponsor banks for settlement — though the deliberate risk-limiting constraints preserve a meaningful gap relative to full Master Accounts.

Conduct, Safeguarding & Promotions

California's conduct regime rests on the California Consumer Financial Protection Law (CCFPL), the foundational statute creating the modern DFPI, which grants broad authority to police unlawful, unfair, deceptive or abusive acts or practices (UDAAP) across financial-service providers, including previously unregulated fintechs. The CCFPL functions as California's de facto state-level conduct regime and analogue to the UK Consumer Duty, extending DFPI reach to firms that previously sat outside formal supervision. This authority applies to both bank-PSPs and non-bank PI/EMI providers, making it a cross-cutting conduct backstop.

Safeguarding of customer funds is structured differently from European safeguarding models and is anchored in the money-transmission framework. Safeguarding for California transmitters rests on minimum net worth (commonly cited $500,000, higher for stored value or virtual currency), eligible-securities backing including FBO accounts titled for the benefit of customers, and a surety bond that must remain active for the licence period; falling below the threshold can trigger suspension. The mechanism is therefore a combination of a net-worth floor, eligible-securities backing — with FBO/trust accounts titled for the benefit of customers recognised as eligible securities — and a regulator-set surety bond in the $250k–$7m range. AB-1116 tightened the regime by including FBO-account treatment as eligible securities and adding a 15-day key-individual notice requirement. This is principally a non-bank PI/EMI safeguarding model; banks safeguard customer funds through deposit-insurance and prudential capital rather than the transmitter net-worth/surety construct.

Outlook

The CCFPL UDAAP authority and the MTA net-worth/surety/FBO-eligible-securities safeguarding model are both established standing positions. The forward direction is continued active DFPI use of UDAAP authority against fintech and crypto consumer harm, with safeguarding thresholds providing the prudential floor that can trigger suspension where breached. No new safeguarding rule change is flagged this cycle beyond the AB-1116 tightening already in force.

Operational Resilience & Critical Infrastructure

California has no dedicated state-level operational-resilience statute for payments; resilience flows primarily from the federal layer and from a single state-specific overlay attached to crypto licensing. At the federal level, FedNow is a 24x7x365 interbank RTGS service with integrated clearing that enhances payment-system safety through redundancy, allowing institutions joining multiple services to establish backup connections in case of an operational outage; 58% of US banks use both RTP and FedNow as an explicit multi-rail resilience strategy. FedNow operates under Regulation J Subpart C plus Operating Circular No. 8. This multi-rail adoption is the principal resilience mechanism available to bank-PSPs, where redundancy across instant-payment rails functions as the operating-continuity strategy.

The only California-specific resilience overlay attaches to digital-financial-asset firms. A DFAL applicant must develop and maintain an information-security and operational-security program, with the DFPI assessing sufficiency following the NIST Cybersecurity Framework 2.0 — the closest California-specific operational-resilience overlay for payments-adjacent crypto firms. This applies to non-bank crypto licensees and is the state's nearest analogue to a dedicated resilience regime.

Outlook

The trajectory is established. There remains a structural gap relative to DORA-style frameworks: California resilience is inferred from federal FedNow/RTP multi-rail adoption plus the DFAL NIST CSF 2.0 infosec overlay rather than a dedicated state regime. No new state resilience statute is signalled this cycle, leaving the federal layer and the DFAL infosec requirement as the operative resilience architecture.

Scheme & Network Compliance

California surcharge compliance sits at the intersection of state law, federal statute and scheme rules. California's 1985 credit-surcharge ban (Civil Code §1748.1) was held unenforceable against similarly situated merchants by the Ninth Circuit in Italian Colors v. Becerra (2018); the Attorney General generally applies that decision while merchants remain barred from misleading customers. SB 478 (drip-pricing, effective 1 July 2024) now requires all-in pricing, restricting surcharges shown as separate line items. The combined effect is that surcharging is permitted under the Italian Colors framework but constrained in visibility by the SB 478 all-in-pricing requirement.

Layered over the state position are the scheme-global and federal caps. Network rules cap credit-card surcharges at 3% (Visa) and 4% (Mastercard) — 3% effective for merchants accepting both — while debit and prepaid card surcharging is prohibited nationwide under the Durbin Amendment and card-network rules, even when debit is run as credit. This produces a tangle of federal Durbin Amendment provisions (debit cap plus debit-surcharge prohibition), Visa/Mastercard caps, and California-specific law that any merchant or acquirer must reconcile. Both bank and non-bank entities are subject to these scheme and federal constraints.

Outlook

The trajectory is stable. SB 478 all-in pricing is in force and Italian Colors governs surcharge enforceability; the scheme caps and Durbin debit prohibition are settled background rules. No new scheme rule change or surcharge-law development is flagged this cycle, but the interaction of SB 478 with the network caps continues to push surcharge visibility downward.

Payment Corridor Dynamics

The US-Mexico remittance corridor is the principal California corridor and the escalating focus of federal supervisory pressure. California's principal corridor is the US-Mexico remittance corridor, with US personal remittances exceeding $72bn in 2024. FinCEN renewed, with modifications, a Southwest Border Geographic Targeting Order on 6 March 2026 requiring certain MSBs to file additional CTRs on currency transactions of $1,000 or more but not more than $10,000, in addition to existing $10,000 CTR and SAR obligations. This lowering of the reporting threshold materially raises the compliance burden on corridor MSBs, most of which are non-bank PI/EMI operators.

The broader supervisory driver is the May 2026 executive order. The 19 May 2026 executive order directs Treasury, FinCEN, the CFPB and federal banking agencies to reassess risks tied to non-work-authorised populations and related cross-border financial activity, citing low-dollar cross-border transfers linked to illicit finance, with short deadlines driving rapid 2026 supervisory developments affecting remittance corridors. A December 2025 data-driven operation targeted 100-plus MSBs, and the May 2026 cross-border executive order drives rapid 2026 supervisory change. The WPM read is on corridor compliance cost, reporting burden and de-risking pressure; the illicit-finance use of the corridor is routed to the financial-crime monitor as a cross-reference rather than a WPM conclusion.

Outlook

The trajectory is escalating. The renewed GTO with its $1,000 CTR threshold, the December 2025 MSB operation, and the short-deadline executive order point to continued rapid supervisory change through 2026, raising compliance cost and de-risking risk for California-origin MSBs serving the US-Mexico corridor.

Industry Structure & Commercial

California is the structural epicentre of US payments and fintech. California (Silicon Valley/Bay Area) is home to Stripe, Square (Block), PayPal, Coinbase and Visa (Foster City), with the market split between large platform incumbents and venture-backed infrastructure firms (embedded payments, card issuing, AI compliance). This structural and competitive landscape view is distinct from the discrete commercial events tracked in the commercial-intelligence module: the concentration of platform incumbents and infrastructure challengers in one geography is itself the analytical feature, irrespective of any individual deal.

The most consequential structural shock in the recent period reshaped startup banking. Silicon Valley Bank, a California state-chartered bank that was the preferred bank of nearly half of all venture-backed tech startups, suffered a bank run and was seized on 10 March 2023 by the DFPI for inadequate liquidity and insolvency; it now operates as a division of First Citizens BancShares, with startup banking now fragmented across state and national banks. The DFPI is the state-chartered bank and credit-union regulator, and the SVB seizure reshaped the startup-banking landscape, fragmenting what had been a concentrated bank-PSP relationship across multiple institutions.

Outlook

The trajectory is stable. The Bay Area remains the structural epicentre, and the post-SVB fragmentation of startup banking is now an established feature of the landscape rather than an active disruption. Structural M&A trends are observed here, while specific announced deals are tracked in the commercial-intelligence module.

Legal & Litigation

Litigation and enforcement across the California payments environment are escalating on three fronts. First, enforcement: the DFPI issued a consent order against Coinme Inc. — the first enforcement action under DFAL — after finding it accepted transactions exceeding $1,000 per customer per day and omitted required receipt disclosures, ordering $51,700 restitution and a $300,000 administrative penalty. This signals an active DFPI enforcement posture on crypto-kiosk consumer harm ahead of the full licensing deadline.

Second, open banking: April 1, 2026 was to be the first Section 1033 compliance deadline, but a federal court has enjoined the CFPB from enforcing the rule while it undertakes reconsideration, leaving a rule that exists on paper but not in practice; the CFPB under Vought declined to defend the Biden-era rule, prompting the Financial Technology Association to intervene in support of the original rule that barred fees. This pushes data-rights questions toward private and state-level litigation.

Third, settlement access: recent appellate decisions — Custodia Bank v. Federal Reserve Board (10th Cir. 2025) and Banco San Juan Internacional v. FRB of New York (2d Cir., 13 May 2026) — frame the contested question of nonbank/novel-institution access to Federal Reserve accounts and services. This cross-links directly to the correspondent-banking and settlement-access module, where the same access question is being addressed through the Fed's Payment Account proposal.

Outlook

The trajectory is escalating across all three fronts. The Coinme action establishes an enforcement template likely to extend as the DFAL deadline approaches; the 1033 litigation leaves data-rights questions unresolved and migrating to state-level and private litigation; and the master-account litigation will continue to shape the contested boundary of nonbank settlement access.

Merchant Acquiring & Risk

Merchant acquiring in California is shaped by the interaction of surcharge rules, federal debit prohibitions and the SB 478 all-in-pricing regime. A compliant surcharge program in California must detect and block debit and prepaid cards (prohibited nationwide, including signature debit run as credit) and cap the surcharge at the lower of actual cost of acceptance or network caps of 3% Visa / 4% Mastercard; SB 478 all-in pricing strictly limits surcharge visibility, pushing acquirers toward interchange-plus or all-in compliant pricing. The practical effect for acquirers is a tightening of permissible surcharge mechanics, requiring card-type detection at the point of acceptance and pricing structures that do not rely on visible separate-line-item surcharges.

This affects both bank and non-bank acquiring participants, and California consumer-protection enforcement by the Attorney General and the Department of Consumer Affairs on improper fees is aggressive, raising the enforcement stakes for non-compliant surcharge programs.

Outlook

The trajectory is stable. SB 478 continues to push acquirers toward interchange-plus or all-in compliant pricing, with the debit and prepaid surcharge block remaining a mandatory control. The forward risk is enforcement-driven rather than rule-change-driven, given aggressive state consumer-protection posture on improper fees.

Product Innovation & Market Development

Product innovation in the California and US market is being shaped by two contested regulatory threads. On open banking, the CFPB finalized its Section 1033 personal-financial-data-rights rule in October 2024 with implementation originally set to begin April 2026, but the rule is currently under litigation and reconsideration — leaving US open banking development in regulatory flux. Payment-initiation scope is contested, given the two largest global card issuers (Visa, Mastercard) are American. This regulatory uncertainty is a key constraint on US pay-by-bank product development, leaving the data-access foundation for account-to-account products unsettled.

On settlement access, the Federal Reserve Board voted 6-1 to advance a proposal creating a special-purpose 'Payment Account' giving fintechs, stablecoin issuers and nonbanks streamlined direct access to Fedwire, FedNow and NSS for clearing and settlement without a bank intermediary — opening new product and infrastructure use cases. This is a thematic product-access regulatory view: the proposal could enable a new class of nonbank settlement products and infrastructure, and cross-links to the correspondent-banking module, where it could displace traditional correspondent relationships.

Outlook

The trajectory is escalating. FedNow and RTP scaling, the DFAL crypto build-out, and the Fed Payment Account proposal together open new product use cases, while the 1033 open-banking rule remains in flux. The forward watch items are resolution of the 1033 reconsideration and the progression of the Payment Account proposal from comment to rule, both of which condition the product-development landscape for account-to-account and pay-by-bank offerings.

Consumer Protection & APP Fraud

California consumer protection for payments differs structurally from the UK model on authorised-push-payment fraud. Unlike the UK, California/the US has no APP-fraud mandatory-reimbursement regime; consumer protection rests on federal Regulation E (EFTA) for unauthorised EFTs and the CCFPL's UDAAP authority plus the DFPI Consumer Services Office complaint process (Form DFPI-801). This means the consumer-protection backstop is a combination of federal unauthorised-transaction rules, state UDAAP authority and an administrative complaint route, rather than a mandated reimbursement framework for push-payment fraud.

Enforcement is active across fintech and crypto. The DFPI actively pursues fintech and crypto consumer harm — including the Coinme action, Bitcoin-ATM cease orders, and the Yotta fintech action. DFAL adds crypto-specific disclosure, receipt and kiosk transaction-cap consumer protections, including a $1,000 daily cap and a fee limit of the greater of 15% or $5. These protections apply across both bank and non-bank providers, with the kiosk-specific caps targeting crypto-ATM consumer harm.

Outlook

The trajectory is established. The absence of an APP-fraud reimbursement mandate persists, with Regulation E, CCFPL UDAAP and the DFPI-801 complaint route as the operative consumer-protection architecture. The forward direction is continued active DFPI enforcement and the layering of DFAL kiosk caps as the digital-financial-asset regime takes effect.

AML/CFT & Financial Crime

This module is sourced from the Sentinel feed; the intelligence below is attributed to Sentinel and no original illicit-finance analysis is performed here. Per the Sentinel feed, every MSB must register with FinCEN (Form 107, renewing every two years), develop and implement a written risk-based AML program designating a compliance officer with policies, training and independent review, and file SARs for suspicious transactions of $2,000 or more — the baseline AML posture for California payment firms. This is the foundational compliance floor for the non-bank PI/EMI population that dominates California money transmission.

Also per the Sentinel feed, FinCEN's April 2026 proposed rule (comments due 9 June 2026) would fundamentally reform AML/CFT program requirements to ensure 'effective' risk-based programs and modernise federal supervision in coordination with banking regulators, reflecting the AML Act 2020 mandate and recent CDD exceptive relief (February 2026). This reshapes program expectations for California payment firms across both bank and non-bank categories. Original illicit-finance analysis on these developments is routed to the financial-crime monitor; the WPM treatment is limited to the payments-context position carried from the Sentinel feed, with full detail available via the Sentinel source links.

Outlook

The trajectory is escalating per the Sentinel feed. The BSA/MSB baseline remains the standing compliance floor, while the FinCEN April 2026 AML program-reform NPRM (comment close 9 June 2026) and continued southwest-border MSB scrutiny point to evolving program expectations through 2026. Substantive illicit-finance analysis remains with the financial-crime monitor.

Commercial Intelligence (M&A, Investment & Product)

The commercial events this cycle cluster around stablecoin and crypto-payments infrastructure. On M&A, Mastercard announced a definitive agreement (March 2026) to acquire stablecoin start-up BVNK in a deal worth up to $1.8 billion including $300 million in contingent payments, expected to close before end of year subject to regulatory review — a stablecoin-payments acquisition by a global card scheme that signals scheme consolidation into stablecoin infrastructure. Separately, Ripple agreed to acquire Rail, a stablecoin-powered global payments platform, for $200 million, expected to close Q4 2025 subject to regulatory approvals.

On funding, business banking fintech Mercury raised a $200 million Series D led by TCV (May 2026) valuing it at $5.2 billion, up 48.6% on its prior $3.5 billion valuation; Mercury landed conditional OCC approval for a US national bank charter in April 2026 — a signal of bank-PSP convergence as a non-bank PI moves toward a national bank charter. And Rain, building stablecoin payments infrastructure, raised a $250 million Series C led by Iconiq Capital (January 2026) at a $1.95 billion post-money valuation, up 17x from the prior March, amid Q1 2026 fintech funding of $12 billion across 751 deals. All four events carry disclosed values. Coverage of private-company California-relevant deals is partial: some trailing-twelve-month events with undisclosed terms were not captured as structured commercial events due to insufficient amount or party data.

Outlook

The trajectory is escalating. Stablecoin and crypto-payments M&A dominate (Mastercard/BVNK at $1.8bn and Ripple/Rail at $200m), alongside large late-stage funding rounds concentrating into fewer, larger deals (Mercury, Rain). The forward direction is continued scheme and infrastructure consolidation into stablecoin payments, with bank-charter convergence (Mercury's conditional OCC approval) as a related signal to watch.