Achieving California Diversity Compliance Successfully

California's venture capital landscape shifted significantly when SB 54 became law in 2023 and SB 164 updated it in 2024.

The current framework is the Fair Investment Practices by Venture Capital Companies Law, known as the FIPVCC.

The first filing deadline is near, and the requirement is operationally heavy even though it is a disclosure law.

This guide explains what the law actually requires and where firms commonly trip up.

What the Law Is Actually Trying to Do

The FIPVCC does not impose investment quotas or hiring mandates.

Its core is public disclosure: covered venture capital firms collect founder demographic information and submit annual reports to the DFPI.

The law aims to improve visibility into who receives venture capital funding across demographic categories.

Who Is Actually Covered

Coverage requires a three-part test, and all three parts must be met.

The determination is fund-by-fund and vehicle-by-vehicle.

Step 1: Venture Capital Company Definition

An entity is a venture capital company if it satisfies at least one of three paths under California Code of Regulations Section 260.204.9(a)(4).

First is the 50% assets test using venture capital investments and derivative investments at cost, excluding certain short-term investments.

Second is qualifying as a venture capital fund under SEC Rule 203(l)-1 and the 1940 Act framework.

Third is qualifying as a venture capital operating company under ERISA's Rule 2510.3-101(d).

A venture capital investment exists when the adviser, fund, or affiliate has management rights in an operating company.

Management rights mean substantial participation, influence, or meaningful guidance rights.

Board seats and observer seats commonly satisfy this test in practice.

Step 2: Primary Business

The entity must primarily invest in startup, early-stage, or emerging growth companies.

The statute does not define these terms.

The JOBS Act definition of emerging growth companies (under $1.235B in annual gross revenue) can be a helpful reference, but it is not controlling here.

Step 3: California Nexus

A covered entity must satisfy at least one of four nexus conditions.

The first is being headquartered in California.

The second is having a significant presence or operational office in California, even though both terms remain undefined.

The third is investing in companies located in or significantly operating in California.

The fourth is soliciting or receiving investments from any California resident.

This final prong is often the broadest.

A single California LP or a single portfolio company investment can be enough under plain statutory text.

Because the analysis is at the vehicle level, one fund can be covered while another is not.

The Two Deadlines

The timeline is tightly set and must be treated as a sequence.

March 1, 2026 — Registration

Every covered entity must register with the DFPI through the VCC Registration Portal.

The required submission includes the entity name, designated point-of-contact name/title/email, and the entity email, phone, physical address, and website.

That information must remain current and updated with annual filings.

April 1, 2026 — First Annual Report

The first report covers qualifying 2025 investments.

Annual reporting then repeats every April 1.

What the Annual Report Must Include

The report has five required components.

Aggregated demographic data

Report aggregated founder demographic data from the DFPI standardized survey in required categories, only to the extent information is actually provided.

Categories include gender identity, race, ethnicity, disability status, LGBTQ+ identification, veteran or disabled veteran status, California residency, and decline-to-answer status.

Diverse founding team metrics: counts

The report must include the number of qualifying investments in businesses primarily founded by diverse founding team members.

The percentage must be reported in total and by category.

Diverse founding team metrics: dollar amount

The report must also include total dollars invested in those same businesses.

That amount must also be shown as a percentage of total investment dollars, total and by demographic category.

Investment-level dollar amount

Each covered entity must report the total amount invested in each portfolio company during the prior year.

Portfolio company principal place of business

Each covered entity must report each portfolio company's principal place of business.

These two investment-level elements are required even if no founder responds to the survey.

A low response rate changes how the diverse metrics calculate, but it does not remove the investment-level filing duty.

How "Diverse" Is Defined

A "diverse founding team member" is self-identification-based across the statutory categories.

This includes women, nonbinary, Black, African American, Hispanic, Latino-Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran or disabled veteran, and LGBTQ+ categories such as lesbian, gay, bisexual, transgender, or queer.

A company is "primarily founded by diverse founding team members" only when more than half of founders respond and at least half of respondents are diverse.

A strong response from a mostly diverse team can still fail the threshold if response levels are too low.

Defining the People You Survey

A "founding team member" is either someone who held initial ownership interests, contributed pre-share founding work, and was not passive, or the CEO/president designation.

The CEO/president path applies independently of the ownership and contribution criteria.

The Survey Process and Why It Gets Complicated

Covered entities must use the DFPI standardized survey form.

Timing constraints

The survey can only be sent after both investment agreement execution and first transfer of funds.

This prevents any perceived coercion around the funding decision.

Anti-influence restrictions

Neither the covered entity nor the DFPI can encourage or pressure founders to participate.

The survey must state participation is voluntary, there is no adverse action for declining, and data is aggregated/anonymized in reporting.

The Anonymization Requirement Is an Engineering Problem

The law requires collection and reporting without associating responses to individual founders.

That means identity-linked collection architectures are generally not sufficient.

The invite process and response process should not be the same system.

If a single system can map identities to answers, the firm risks non-compliance.

Solo-founder companies require special care to avoid re-identification by inference.

Consolidated Reporting

A business that controls a covered entity may submit a consolidated report for multiple covered entities.

The statute does not comprehensively define control, so firms should document the legal basis for the chosen filing structure.

Penalties, Cure Periods, and Public Exposure

Late filing triggers notice and a 60-day cure period.

If unresolved, the DFPI may seek injunctive relief, recovery of fees and costs, and civil penalties up to $5,000 per day.

Reckless or knowing violations can exceed that level.

Minimum filing fee is $175 per report, with potential adjustment.

Reports are publicly searchable and downloadable.

Public filings amplify reputational risk for non-compliance or inaccurate filings.

Privacy Obligations Beyond the FIPVCC

The collected data is sensitive personal information in many legal frameworks, including likely CCPA treatment.

Covered firms should publish and follow a privacy policy covering retention, access controls, and disposal procedures.

The record retention clock is at least five years, but records must remain identity-safeguarded.

What Firms Should Do Right Now

Confirm which funds and vehicles are covered.

Build the 2025 investment-level dataset now: investment amounts and principal place of business.

Identify eligible founding team members and timing for survey distribution.

Use a purpose-built collection process that enforces anonymization by design.

Monitor DFPI guidance closely as registration and reporting systems mature.

Conclusion

FIPVCC compliance is an engineering problem dressed in legal language.

Comply with VCC was built to separate invitation identity from response content, aggregate in real time, discard raw submissions, and preserve a non-identifying audit trail for five years.

With deadlines approaching, this architecture is now a filing requirement, not a competitive advantage.

If this applies to your firm, start your 2025 filing at https://www.complywithvcc.com.