Understanding the California Diversity Reporting Law

In 2023, California enacted a transparency mandate for the venture capital industry. The law, now known as the Fair Investment Practices by Venture Capital Companies Act (FIPVCC), requires certain firms to collect and publicly report demographic information from portfolio founders via the DFPI.

The first annual filing deadline is April 1, 2026, and it covers qualifying investments from calendar year 2025.

The surface-level requirements look simple. The operational reality is more difficult because firms need robust technical controls and disciplined process design.

Where the Law Came From

The initial framework was passed as SB 54 in 2023 and revised by SB 164 in 2024.

The revisions transferred oversight to the DFPI and narrowed the scope so it focuses on entities that fit the venture capital company definition rather than a broader assets-management-only approach.

The law also adjusted reporting mechanics, including how firms should treat diversity metrics and who is captured under diversity reporting thresholds.

Who Is Actually a Covered Entity

Coverage is determined by a three-part test. All three parts must be satisfied.

Coverage is assessed at the individual fund or vehicle level, not only at adviser level.

A fund can have covered and non-covered vehicles under the same management structure.

Step 1: Does the entity qualify as a venture capital company?

Under California Code of Regulations Section 260.204.9, an entity qualifies as a venture capital company by satisfying at least one path.

One path is the 50% asset test: at least half of assets (valued at cost) must be venture capital investments during each annual period from initial capitalization.

A second path is qualification as a venture capital fund under the Investment Advisers Act of 1940.

A third path is qualification as a venture capital operating company under ERISA.

Management rights are central to the core investment definition. This includes securities in an operating company where the adviser or an affiliate has rights to substantially participate in or influence the company.

Board seats and observer seats typically satisfy management rights in practice.

Step 2: Does the entity primarily invest in startup, early-stage, or emerging growth companies?

These terms are not expressly defined in the statute, so firms should rely on how they describe strategy in offering documents and investor materials.

Step 3: Does the entity have a California nexus?

A nexus exists if any one condition is met: headquartered in California, having significant presence or operational office in California, investing in California-based or significantly operated businesses, or soliciting/receiving investments from California residents.

The investor-based nexus condition is notably broad and can include firms headquartered elsewhere.

The legal scope can therefore be national for firms with any California resident LP flow.

The Two Deadlines and What Each Requires

There are two core dates that should drive every timeline.

March 1, 2026: Registration

Covered entities register with the DFPI and provide identifying/contact details: legal name, designated point of contact, and entity contact channels.

Information must be kept current and updated for each annual filing cycle.

April 1, 2026: First Annual Report

The report covers all qualifying investments made during calendar year 2025 and repeats annually thereafter.

The report has three major components.

The first component is aggregated demographics for founding team members from portfolio companies with survey responses.

The second component is diverse-founding-team metrics: number and dollar share of investments in businesses meeting the majority-diverse threshold.

The third component is investment-level data: total invested amount and principal place of business for each qualifying portfolio company.

The investment-level component is required regardless of survey response rates.

Defining the People at the Center of This

The reporting framework depends on precise definitions of who counts.

Who is a founding team member?

A qualifying founding team member is either: a person with initial ownership, pre-issuance contribution, and no passive investor status; or someone designated as CEO or president.

Who is a diverse founding team member?

Diversity status is based on self-identification across protected categories defined by the statute.

Those categories include women, nonbinary, Black, African American, Hispanic, Latino/Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran/disabled veteran, lesbian, gay, bisexual, transgender, or queer.

What does "primarily founded by diverse founding team members" mean?

This measure requires both a response-rate condition and a diversity threshold.

More than half of the founders must respond, and at least half of respondents must self-identify as diverse under the statute.

Response shortfall can cause a company to miss qualification even with diverse composition.

The Survey Rules and the Technical Problem They Create

The DFPI publishes a standardized survey form that must be used.

Surveys must be distributed only after the investment agreement is executed and the first transfer of funds is made.

No coercion is permitted, and participation must be voluntary.

Survey disclosures must state that declining participation will not result in adverse action and that only aggregated data will be reported.

Most critical is the anonymization requirement: survey data must not be associated back to individual founders.

General-purpose tools often preserve response metadata and create identity linkage, which can conflict with statutory anonymization limits.

Solo-founder companies create added re-identification risk and must be protected through shielding rules.

The retention and examination tension

Firms must retain records for at least five years and support DFPI examination requests, while avoiding individually identifiable response storage.

That tension requires careful architecture: aggregate outputs and audit trails without individual response linkage.

What Happens If You Don't File

Late filings trigger notice and a 60-day cure period.

If not cured, enforcement can include attorney-fee recovery, injunctive relief, and civil penalties up to $5,000 per day of non-compliance.

Reckless or knowing violations can support higher outcomes.

The Commissioner also evaluates financial standing and prior history when determining penalties.

Reports are public. Reputational impact from a filing lapse or flawed filing is often meaningful beyond financial exposure.

The Broader Picture

The law is disclosure-based, not quota-based.

It does not require firms to shift investment allocation because of race, gender, or other identity criteria.

Key terms remain open in practice, including significant presence, operational office, and the practical boundaries of jurisdictional nexus.

Until guidance is clearer, conservative compliance practice is to assume coverage and plan for full obligations.

Getting This Done Without Building a Data Infrastructure

The real difficulty is architectural: firms need to collect sensitive demographics, aggregate data in real time, and keep audit logs without storing identifiable founder-level responses.

Most teams should adopt a purpose-built workflow for this compliance class of data handling.

Comply with VCC was built for this workflow: invitation identity is separated from response processing, raw responses are discarded, solo-founder shielding is automatic, and five-year auditability is preserved without identity linkage.

If this filing is required for your firm, start your 2025 filing process at https://complywithvcc.com.