A DFPI crypto examination or records request requires more than sending policies and wallet screenshots. Your California business needs a coordinated response explaining what happened, which records support the explanation, and how identified problems are being addressed.

The Department of Financial Protection and Innovation may ask questions that cross compliance, finance, engineering, and customer support. Assigning responsibility early helps prevent inconsistent answers, missing records, and unsupported assurances about customer assets.

Quick Answer

Confirm the request's authority, scope, deadlines, and delivery method. Assign a response lead, preserve relevant records, and reconcile customer obligations against assets under control. California Financial Code sections 3301, 3303, and 3503 address examinations, recordkeeping, and customer asset requirements under the Digital Financial Assets Law. Document discrepancies and corrective action accurately. The workflow below provides practical recommendations; the specific request and applicable requirements control.

Define the Scope of the DFPI Crypto Examination

Financial Code 3301 authorizes examinations of licensees and their agents, including offices outside California, and permits examination without advance notice. It also requires relevant personnel to provide requested records and facilitate the examination.

Read the notice carefully. Identify the legal entity, products, customer population, review period, and systems covered. Distinguish a supervisory examination from an investigative demand or another type of request, because authority and response obligations may differ.

Create a request tracker recording each item, responsible person, deadline, source system, review status, and submission date. Ask promptly about unclear terminology or unavailable formats. If more time is needed, request it before the deadline and obtain confirmation rather than assuming an extension.

Assign Responsibility Before Collecting Documents

Designate one response coordinator with authority to obtain information across departments. Assign finance to balances, engineering to system exports, operations to transaction workflows, and compliance to policies and customer issues.

Legal counsel should evaluate scope, privilege, sensitive disclosures, and potential violations. Copying an attorney on routine business communications does not automatically make them privileged.

Identify who actually controls wallets and approves transfers. Problems involving private-key control by founders, employees, or agents can complicate both record collection and explanations about operational responsibility.

Prepare interview participants to describe their own work accurately. Employees should distinguish personal knowledge from assumptions and identify when another team must verify an answer.

Preserve the Records Behind Your Answers

Financial Code 3303 requires licensees to retain specified records for covered activity involving California residents for five years after the activity. Those records include transaction information, accounting records, bank reconciliations, and customer dispute reports.

Map the request to relevant systems and suspend applicable routine deletion while preservation obligations are assessed. Include archived databases, messaging platforms, support tickets, vendor portals, and former employees' business records.

Preserve original exports and document how they were generated. The same discipline that supports reliable crypto evidence in legal proceedings helps explain where examination data came from.

Record collection dates, custodians, filters, and transformations. Maintaining a clear chain of custody for collected evidence can help distinguish original records from later analysis. Preserve historical policies rather than replacing them with newly revised versions.

Reconcile Customer Assets for the DFPI Crypto Examination

Financial Code 3503 generally requires a covered person controlling customer digital assets to maintain sufficient amounts of each asset type to satisfy aggregate customer entitlements. A total dollar-value dashboard may therefore be insufficient.

Prepare a reconciliation that connects:

• Customer balances and obligations in the internal ledger.
• Assets in identified hot wallets, cold wallets, and custodial accounts.
• Pending deposits, withdrawals, settlements, and internal transfers.
• Company-owned assets, separately identified from customer assets.
• Unexplained differences and their investigation status.

Use consistent timestamps, networks, token identifiers, and units. Explain decimal precision, transaction finality assumptions, and how duplicate entries are prevented.

For third-party holdings, collect statements, agreements, and evidence of withdrawal rights or restrictions. Issues underlying crypto custody disputes can affect whether a reported balance adequately supports your explanation.

Investigate transfers between customer and operating accounts. Questions about crypto treasury management require transaction-level support, not simply management's statement that funds are available.

A single clean snapshot does not demonstrate continuous compliance. Review requested historical periods and explain significant exceptions. If stablecoin requirements apply, reconcile the relevant reports with records supporting Financial Code section 3601 compliance.

Make Each Production Complete and Understandable

Use a consistent index connecting each submitted file to a request item. Include definitions for technical fields, explain exclusions, and identify supplemental records still being collected.

Check totals against previously submitted reports. If two reports differ because they use different customer populations or timestamps, explain that distinction rather than silently changing one.

Use an agreed secure transmission method. Review customer identifiers and access permissions in light of applicable crypto user privacy requirements. Privacy concerns should be addressed through lawful handling and documented discussions, not unexplained withholding.

Do not include seed phrases or operational credentials in routine document packages. Coordinate any sensitive access or control-verification request through counsel and security personnel, considering relevant virtual currency cybersecurity risks.

Document Corrective Action With Evidence

If the review reveals a discrepancy, preserve the original records and investigate its cause. Do not backdate policies, overwrite logs, or describe a proposed fix as completed.

Maintain a corrective-action log identifying:

• The issue and how it was discovered.
• Affected systems, transactions, customers, and periods.
• Immediate containment measures.
• The responsible owner and completion target.
• Testing results and remaining exceptions.

For example, an outage affecting withdrawal processing should be supported by incident records and customer communications relevant to crypto platform outage disputes. Complaints about restricted access should match the documented reasons for an exchange account freeze.

If you introduce automated blockchain compliance controls, retain test results showing what the system detects and misses. Installing software alone does not establish that the underlying problem is resolved.

Frequently Asked Questions

Does a DFPI examination mean the business violated the law?

No. Examination is a supervisory tool. Nevertheless, the findings and responses may reveal issues requiring remediation or further regulatory action.

What if a vendor has the requested records?

Contact the vendor promptly, preserve available copies, and document retrieval efforts. Explain any gap and proposed delivery schedule. Outsourcing storage does not make the records irrelevant to the examination.

Is proof of reserves enough?

Not necessarily. A reserves report may not establish complete customer liabilities, ownership, restrictions, or coverage throughout the review period. Explain its methodology and limitations.

Should we correct an inaccurate response?

Yes. Coordinate a prompt, clearly labeled correction identifying the affected submission, revised information, and reason for the change. Retain both versions and supporting records.

DFPI Crypto Examination Lawyers in California

Bulldog Law helps businesses evaluate examination requests, organize legally reviewed responses, and document corrective action. Bring the notice, request tracker, prior submissions, reconciliation reports, and known discrepancies so counsel can assess the response obligations and issues requiring attention.