Understanding the California VC Diversity Report

California's venture capital industry now operates under a formal disclosure regime for covered firms. If your fund has a California connection, you may be required to collect founder demographics and file an annual report to the DFPI.

The first California VC diversity report is due April 1, 2026, and covers 2025 qualifying investments.

This is not a simple paperwork exercise. The requirement combines sensitive information handling with strict limits on identifiable retention.

Where the Law Comes From

The framework began as SB 54 in 2023 and was revised by SB 164 in 2024.

SB 164 transferred administration from the Civil Rights Department to the DFPI and narrowed the broad catch-all pathway that previously could have captured entities with minimal direct venture focus.

DFPI now administers the registration, standardized survey, template, and enforcement process.

Who Has to Comply: The Three-Part Test

Coverage is tested at the vehicle level, not only at adviser level.

Each fund or vehicle can have a different outcome.

First: Is the entity a venture capital company under California Code of Regulations 260.204.9?

A fund qualifies if it satisfies at least one condition: the 50% assets path, the venture capital fund path, or the venture capital operating company path.

For the 50% assets path, at least half of assets (excluding certain short-term investments) must be venture capital investments.

A venture capital investment is defined through management rights — the contractual or ownership-based right to substantially participate in, influence, or guide a portfolio company.

Board seats and board observer seats are often enough to satisfy management rights.

The second path comes from the 1940 Investment Advisers Act framework for venture capital fund status.

The third path is venture capital operating company status under ERISA.

Second: Is the entity primarily investing in startup, early-stage, or emerging growth companies?

Those terms are not fully defined in the statute.

Fund strategy language in private placement materials and investor reporting should guide this practical analysis.

Third: Does the entity have a California nexus?

A nexus can exist if the entity is headquartered in California, has significant presence/operational office in California, invests in businesses with California operations, or solicits/receives California resident investment.

The LP-based prong creates broad national reach. A single California LP can be enough.

Undefined terms remain a practical source of uncertainty, and most counsel still recommend assuming coverage where there is reasonable nexus exposure.

The Two Compliance Deadlines

There are two key deadlines.

March 1, 2026: Registration

Covered entities must register with the DFPI and provide entity and point-of-contact details.

Registration data should remain current for subsequent annual filing cycles.

Failure to maintain current records can create notice-and-cure risk.

April 1, 2026: First Annual Report

The first filing covers prior-year (2025) qualifying investments, and then repeats annually.

What the Annual Report Contains

The annual report has three components.

Founding Team Demographic Data

For each qualifying portfolio company, report aggregated founding-team demographic data for all required categories, to the extent founders responded.

The required categories are gender identity, race, ethnicity, disability status, LGBTQ+ identification, veteran status, California residency, and decline-to-respond status.

Diverse Founder Investment Metrics

The report must show both the number and dollar amount of investments in businesses primarily founded by diverse founding team members as percentages.

A diverse founding team member is determined by statutory self-identification categories.

The majority thresholds are response-rate based: more than half of founders must respond, and at least half of those respondents must be diverse.

Investment-Level Data

The total amount invested in each qualifying portfolio company and each company principal place of business must be reported.

This requirement applies regardless of survey completion.

The Survey: Timing, Restrictions, and Anonymization

The DFPI standardized survey form must be used.

Timing Restriction

Surveys are only permitted after investment agreement execution and first transfer of funds.

This avoids coercion.

Anti-Coercion and Disclosure Rules

Neither the covered entity nor the DFPI may influence a founder's participation decision.

Surveys must state participation is voluntary, there is no adverse action, and reporting is aggregated.

Anonymization Requirement

The law requires collection and reporting without associating responses with identifiable founders.

A process that stores names, emails, or submission-level identity data before aggregation generally creates compliance risk.

Solo-founder companies require additional shielding because aggregate output can be effectively identifiable.

Record Retention, Fees, and Enforcement

Covered entities must keep related records for at least five years after each report.

The DFPI can examine those records and request documents or written responses.

Each submission includes a minimum $175 filing fee, with possible administrative adjustment.

Late filing starts with written notice and a 60-day cure period.

After the cure period, penalties can include civil fines up to $5,000 per day and potentially higher outcomes in reckless or knowing cases.

The Commissioner's penalty analysis includes financial standing, AUM, seriousness of failure, and prior history.

Public posting of reports adds significant reputational risk for firms with late or deficient filings.

Consolidated Reporting

A controlling business may submit consolidated filings for multiple covered entities in some circumstances.

The statute does not define control in detail, so each filing structure should be documented and reviewed in practice.

The Practical Challenge This Creates

The core tension is this: firms must collect sensitive data but cannot retain founder-level identifiable records.

Compliance therefore requires architecture where invitation systems and response-processing systems are separated.

Real-time aggregation and minimal persistent identity data are essential.

Conclusion

The FIPVCC creates a reporting and systems problem, not just a legal summary problem.

Teams need an implementation path that supports anonymization, survey timing, and long-term retention obligations.

Comply with VCC was built for this structure: separate invite and response layers, real-time aggregation, solo-founder shielding, and auditability without identity linkage.

If this reporting applies to your firm, begin your 2025 process at https://complywithvcc.com.