On August 18, 2025, Illinois Governor JB Pritzker signed Senate Bill 1797, enacting, in his words, "first-of-their-kind safeguards in the Midwest for cryptocurrency and other digital assets."1 This Illinois law is the Digital Assets and Consumer Protection Act (DACPA or the Act), which establishes an Illinois-state-level regulatory framework for centralized crypto exchanges that have customers and certain other digital asset businesses operating in Illinois. DACPA will be administered and enforced by the Illinois Department of Financial and Professional Regulation (IDFPR).
Highlights of this bill include:
- Granting IDPFR authority to regulate and supervise digital asset businesses and centralized digital asset exchanges under the DACPA and the existing Corporate Fiduciary Act (205 ILCS 620).
- Establishing consumer protections said to be in line with those that apply to traditional financial services, such as investment disclosures, customer asset safeguards, and customer service standards.
- Requiring adequate financial plans and procedures for addressing critical risks, including cybersecurity, fraud, and money laundering, consistent with regulations for traditional financial services.2
The fact sheet touts that more states are enacting digital asset regulation, including New York and California.3 Objectively, the enactment of DACPA appears to be politically motivated, based on statements by Governor Pritzker and other Illinois politicians in the accompanying press release, such as this: "While the Trump Administration is letting crypto bros write federal policy, Illinois is implementing common-sense protections for investors and consumers," and this: "At a time when fraudsters continue to evolve and consumer protections are being eroded at the federal level, Illinois is sending a clear message that we won't tolerate taking advantage of our people and their hard-earned assets."4
Does Illinois have the resources to enforce DACPA, or even to process applications to register under the Act? Illinois's strained resources seem to indicate otherwise.
Regarding the IDFPR, there is no indication that the current staff has the resources, capabilities, or digital asset industry domain expertise to administer or enforce DACPA effectively. In terms of its current limited resources, a review of the enforcement actions for the Banking Division Orders and Enforcement Actions for Banks, Trust Companies and Savings Institutions Enforcement Actions reveals that IDFPR has only brought the following number of actions in this area in the past five years: 2020, four actions; 2021, three; 2022, two; 2023, one; and 2024, four.5 Thus far in 2025, IDFPR has instituted two enforcement actions. Of the 16 actions instituted since 2020, not one of them appears to involve digital assets.6
Turning to the highlights of DACPA, notably in Section 1-10 regarding applicability, Section 1-10(a) provides that the Act governs digital asset business activity of a person or entity doing business in Illinois "to the extent not preempted by federal law." Section 1-10(b)(1)(A) continues to provide that DACPA does not apply to the extent that the Securities Exchange Act of 1934 governs the activity as a securities transaction and the activity is regulated by the SEC or the Illinois Secretary of State. Also, Section 1-10(b)(1)(B) provides that DACPA does not apply to the extent that the Commodity Exchange Act governs the activity, and the activity is regulated by the Commodity Futures Trading Commission (CFTC). Thus, from the start, the applicability of DACPA is limited by federal preemption, regulation by the SEC, and regulation by the CFTC. Although Governor Pritzker hasn't mentioned this, what remains of DACPA might well be preempted by the so-called "CLARITY Act" or by other federal digital assets legislation pending in Congress.
For the digital assets entities to which DACPA applies, the scope of the Act is quite broad. Section 1-15 provides "general powers and duties" that include the following: the issuance, revocation, or suspension of registration; to receive, consider, investigate, and act upon complaints made by any person related to any digital asset business activity in Illinois; to subpoena documents and witnesses and compel their production and attendance; to issue orders; to examine the books and records of every covered person, entity, affiliate or service provider; to enforce the provisions of the Act and any state or federal law applicable to digital asset business activity; to levy fees, fines, and civil penalties; to conduct hearings; and more.
How will an Illinois state agency with limited and strained resources attempt to cover the needed resources for implementing and enforcing DACPA? It appears it will do so by obligating industry funding. In Section 1-20, DACPA addresses the expenses of administering this Act. Specifically, it mandates that the expenses of the Act, including those for investigations and examinations, will be borne by and assessed against those regulated by DACPA. Section 1-20 lists the ways that IDFPR may establish fees by rule, which include registration, examination, and investigation fees. It is understood that these fees are being imposed to generate revenue for use in hiring government staff to administer and police DACPA.
DACPA states requirements for customer protection in Article 5. These protections include customer disclosures (Section 5-5); custody and protection of customer assets (Section 5-10); requirements for covered exchanges (Section 5-15); and additional requirements. Article 10 then states compliance requirements. These include policies and procedures (Section 10-10) that cover the following: a cybersecurity program; a business continuity program; a disaster recovery program; an anti-fraud program; an anti-money laundering program; a conflict-of-interest program; and more. Article 15 provides the requirements for registration under DACPA. Article 20, addressing supervision, provides for surety bond and capital and liquidity requirements. Section 20-5 requires a surety bond or trust account in U.S. dollars in a form and amount determined by IDFPR and the maintenance at all times of capital and liquidity in an amount and form that IDPFR determines is sufficient to ensure the financial integrity of the registrant.
In conclusion, the requirements of DACPA are quite broad and demanding. Persons conducting digital asset business activity in Illinois or, wherever located, who engage in or hold themselves out as engaging in that activity for or with an Illinois resident, must register with the IDFPR by July 1, 2027, unless exempt. The IDFPR may, by rule or order, create exemptions to the Act. Applications for exemption can and should be made by competent legal counsel.
DACPA regulation already exempts peer-to-peer exchanges or transfers of digital assets, decentralized exchanges (such as Uniswap), software development, the issuance of non-fungible tokens, mining, and validation. Proprietary trading for one's own account is not considered "exchange" and is therefore outside the scope of the Act. Again, DACPA and other similar state laws might be preempted by the adoption of the CLARITY Act or other federal legislation. Until that happens, we stand ready to interpret the Act, to process registrations under the Act, to seek exemptions from the Act where appropriate, and to defend businesses investigated for, or charged with, violating the Act.
Footnotes
2. See https://idfpr.illinois.gov/content/dam/soi/en/web/idfpr/forms/dacpa-fact-sheet.pdf.
3. Id.
5. See https://idfpr.illinois.gov/banks/cbt/enforcement.html.
6. Id.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
