February 12, 2026 · 20 min read
VCC Compliance: A Complete Guide
A practical, deadline-focused guide to who is covered by the FIPVCC, what must be reported, and how firms can avoid the most common compliance pitfalls.
California's venture capital reporting law has been on the horizon for a while, but with the March and April 2026 deadlines now coming quickly, covered firms need a practical implementation plan.
The Fair Investment Practices by Venture Capital Companies Act, known as the FIPVCC, was first enacted as SB 54 in 2023 and replaced by SB 164 in 2024.
The current law is codified at California Corporations Code Section 27500 et seq. and enforced by the California Department of Financial Protection and Innovation.
For covered entities, compliance requires registration by March 1, 2026, and an annual filing covering calendar year 2025 investments due April 1, 2026.
The first filing is already time-sensitive because it depends on 2025 data.
What the Law Actually Requires
The FIPVCC requires two core actions: DFPI registration and an annual report.
Registration is required by March 1, 2026.
The annual report is due April 1, 2026, and includes mandatory demographic and investment disclosures for qualifying prior-year activity.
Who Is a Covered Entity
Coverage is determined through a three-part test at the fund or vehicle level.
A manager may need to treat each vehicle differently based on this test.
Step 1: Venture Capital Company Definition
The entity must qualify as a venture capital company under California Code of Regulations Section 260.204.9(a)(4).
It qualifies if it satisfies any one of three paths.
First, at least 50% of its assets (excluding certain short-term pending investments, valued at cost) must be in venture capital investments on at least one occasion during each annual period from initial capitalization.
A venture capital investment includes securities acquired in an operating company where the adviser, entity, or affiliate obtains management rights.
Management rights include the ability to substantially participate in, influence, or guide the company.
Board seats and board-observer seats are often sufficient in practice.
Second, the entity may qualify as a venture capital fund under SEC Rule 203(l)-1 under the Investment Advisers Act of 1940.
Third, it may qualify as a venture capital operating company under DOL Rule 2510.3-101(d) under ERISA.
Step 2: Primary Business
The entity must primarily engage in investing in or financing startup, early-stage, or emerging growth companies.
The statute does not fully define these terms.
The JOBS Act's emerging growth company definition (revenues under $1.235 billion) can offer guidance, but it is not incorporated into FIPVCC directly.
How the firm describes its strategy in offering documents and investor reporting remains important.
Step 3: California Nexus
The entity must satisfy one of four nexus criteria.
Headquartered in California.
Significant presence or an operational office in California, though both are currently undefined.
Making investments in companies located in or significantly operating in California.
Soliciting or receiving investments from any California resident, including family offices and high-net-worth investors.
A single California LP can be enough to trigger covered-entity status in many cases.
The practical result is a broad national reach for firms with California investor connections.
Until legal outcomes narrow the statute, the practical compliance posture is to assume coverage where criteria are plausibly met.
The Two Deadlines and What Each Requires
There are two milestone deadlines with different filing implications.
March 1, 2026 — Registration
Each covered entity must provide identifying information to the DFPI, including entity name, point-of-contact name/title/email, and contact details like email, phone, address, and website.
Information must be kept current and updated with annual filings.
As of February 2026, teams should continue monitoring the DFPI portal for registration availability.
April 1, 2026 — Annual Report
The first annual report covers calendar year 2025 and then repeats each April 1.
The report includes three broad components.
What the Annual Report Contains
Component one is founding team demographic data, reported at an aggregated and anonymized level.
Reporting is limited to founder responses actually received through the DFPI survey.
The required categories are gender identity, race, ethnicity, disability status, LGBTQ+ identification, veteran or disabled veteran status, California residency, and decline-to-respond status.
Component two is diverse founder investment metrics.
Covered entities must report the percentage and dollar share of investments in businesses primarily founded by diverse founding team members.
These metrics must be reported in aggregate and by category, and only based on qualifying survey responses.
A business is primarily founded by diverse founding team members only when survey response and diversity thresholds are satisfied.
Component three is investment-level data.
The report must include total dollars invested in each portfolio company and each company's principal place of business.
This requirement applies regardless of survey response, including no-response scenarios.
Defining the People You Must Survey
A person is a "founding team member" if they meet all three ownership/contribution/non-passive conditions, or if they are the CEO or president.
The CEO or president path is an independent qualifier.
A "diverse founding team member" self-identifies in one of the statute's protected categories.
These include woman, nonbinary, Black, African American, Hispanic, Latino-Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran or disabled veteran, lesbian, gay, bisexual, transgender, or queer.
The Survey Process and Its Legal Constraints
The DFPI standardized VC demographic survey must be used.
It cannot be replaced with a custom form.
Survey distribution is constrained by timing and anti-coercion rules.
Surveys can be distributed only after investment agreement execution and first transfer of funds.
The process cannot include incentives or influence over participation decisions.
The form must clearly state voluntary participation, no adverse action for decline, and that reporting is aggregated and anonymized.
The Anonymization Problem
This is the compliance architecture challenge for most firms.
The law requires aggregate outputs while prohibiting identifiable storage and linkability to individual founders.
At the same time, firms must keep records for at least five years and support DFPI exam requests.
Using Google Forms or manually handling founder-level spreadsheet responses can create non-compliant linkage risk.
The invitation layer and response-processing layer should be separated.
Solo-founder companies create re-identification risk and must be handled through explicit shielding protections.
Consolidated Reporting
A business that controls a covered entity may file consolidated reports for multiple covered entities.
The statute does not define "control," so firms should document the legal basis and scope of consolidated filings.
Fees, Penalties, and the Cure Period
Each annual report filing has a minimum $175 fee.
Late filings trigger written notice and a 60-day cure period.
The same cure mechanics apply to failures to update registration records.
If non-compliance continues after cure, the DFPI may pursue injunctive relief, cease-and-desist orders, fee recovery, and monetary penalties up to $5,000 per day.
Reckless or knowing violations can result in higher penalty outcomes.
Reputational risk is separate: all submitted reports and related outcomes are public and searchable.
What to Do Right Now
First, complete entity-by-entity covered-entity analysis.
Second, decide whether consolidated filing or separate fund filing is appropriate.
Third, assemble the 2025 investment-level dataset: amount invested and principal place of business for each portfolio company.
Fourth, distribute the standardized survey where timing rules permit.
Fifth, verify that your data handling architecture is anonymity-compliant before collection begins.
Record retention lasts at least five years from each report delivery.
The architecture and process must preserve a compliant audit trail while preventing identity linkage.
Conclusion
VCC compliance is not just a filing obligation.
It is a systems problem: collect sensitive founder data in real time, aggregate it without storing individual responses, retain required records, and keep records from becoming identity-linked.
Comply with VCC is purpose-built for this: invite identity and response processing are separated, responses are aggregated immediately, raw submissions are discarded, solo-founder re-identification protections are applied, and a five-year audit trail is maintained without personal linkage.
If this filing is required for your firm, start your 2025 filing preparation now.