This law requires applicants and licensees in digital financial asset businesses to establish and maintain several key programs and policies. These include security, business continuity, disaster recovery, and anti-fraud programs, as well as measures to prevent money laundering and terrorist financing. Licensees must ensure these policies are robust, adapted to their specific business activities, and in sync with other applicable laws.

Fraud detection policies must evaluate risks and undergo regular updates. Anti-money laundering policies should align with federal laws, and information security policies must protect sensitive data. Policies need to be clear to consumers, and a designated person should oversee them.

Licensees can seek guidance from the department on compliance and possibly outsource certain tasks. Failure to meet policy goals doesn't automatically mean liability unless there is evidence of systemic issues. Most policies must be disclosed separately, but those concerning certain security aspects may remain confidential for safety reasons.

Before applying for a license, businesses must set up and keep a record of policies and procedures ensuring they follow not just this financial regulation but also any other relevant state laws. These policies need to align with both state and federal laws and can be adapted from existing procedures used in digital financial activities.

Once these policies are established, the business must appoint a qualified person to oversee, promote, and enforce them. Businesses can ask for guidance from the department on these policies and can outsource non-compliance tasks if approved. If a policy doesn't work once but was properly made and monitored, the business won't be liable. However, repeated failures suggest the policy was not appropriately handled.