California's Fair Investment Practices by Venture Capital Companies Law Imposes New Registration and Reporting Obligations

What Is a "Covered Entity"?

To be subject to the FIPVCC, an entity must satisfy three criteria: (1) qualify as a "venture capital company," (2) primarily engage in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies, and (3) maintain a specified California nexus.

1. Venture Capital Company Definition

Under the FIPVCC, a "venture capital company" includes any entity that satisfies any of the following conditions:

• On at least one occasion during the annual period commencing with the date of its initial capitalization, and on at least one occasion during each annual period thereafter, at least 50 percent of its assets (other than short-term investments pending long-term commitment or distribution to investors), valued at cost, are venture capital investments or derivative investments.
• The entity is a "venture capital fund" as defined in Rule 203(l)-1 under the Investment Advisers Act of 1940.
• The entity is a "venture capital operating company" as defined in Rule 2510.3-101(d) under ERISA.

The definition of "venture capital investments" focuses on acquisitions of securities in operating companies in which the investment adviser or its affiliates obtain "management rights," which is the right to substantially participate in or influence the management, operations, or business objectives of the operating company.

2. Business Focus Requirement

The venture capital company must be "primarily engaged in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies." These terms are not defined in the FIPVCC, and the DFPI has not offered guidance on what companies fall under those terms.

3. California Nexus

A venture capital company has the requisite California nexus if it meets any of the following conditions:

• The company is headquartered in California.
• The company has a significant presence or operational office in California.
• The company makes venture capital investments in businesses that are located in, or have significant operations in, California.
• The company solicits or receives investments from a person who is a resident of California.

The fourth prong is particularly broad. Because soliciting or receiving investment from a single California resident satisfies the nexus test, only private funds that specifically exclude all California residents from fundraising activities will likely be exempt. As a practical matter, this means that most U.S.-based venture capital funds, even those headquartered outside California, will likely be covered entities under the law.

Registration Requirements

Each covered entity must register with the DFPI by submitting: (1) the covered entity's name, (2) the name, title, and email address of the designated point of contact, and (3) the covered entity's designated email address, telephone number, physical address, and website address. The online registration portal is now available on the VCC Reporting Program website.

Annual Reporting Obligations

By April 1, 2026, and each April 1 thereafter, covered entities must submit a report to the DFPI containing information regarding venture capital investments made during the immediately preceding calendar year.

Critical clarification regarding scope of reporting: Once an entity qualifies as a covered entity (by satisfying any California nexus test), it must report on all venture capital investments made during the prior calendar year, not just investments in California-based companies. For example:

• A venture capital fund headquartered in New York with a single California-based LP must report on all of its portfolio companies, including those located in Texas, Florida, or any other state.
• A venture capital fund that makes one investment in a California startup but has ten other investments in non-California companies must report on all 11 investments.

The California nexus requirement determines whether a fund is covered; once covered, the reporting obligation extends to the fund's entire investment portfolio for the relevant year.

Founding Team Member Demographic Data

The report must include the following demographic information for each "founding team member" of each business in which the covered entity made a venture capital investment during the prior calendar year, presented on an aggregated basis (to the extent voluntarily disclosed by the founding team member):

• Gender identity (including nonbinary and gender-fluid identities)
• Race
• Ethnicity
• Disability status
• LGBTQ+ identification
• Veteran or disabled veteran status
• Status as a California resident
• Whether the founding team member declined to provide such demographic information

A "founding team member" is defined as either: (a) a person who owned initial shares or similar ownership interests of the business, contributed to the concept of, research for, development of, or work performed by the business before initial shares were issued, and was not a passive investor in the business; or (b) a person who has been designated as the chief executive officer or president.

Investments in Businesses Primarily Founded by Diverse Founding Team Members

The report must also include (1) the total number of venture capital investments made by the covered entity in businesses primarily founded by diverse founding team members, expressed as a percentage of the total number of venture capital investments made, broken down into the categories of demographic information listed above (anonymized to the extent possible), and (2) the total amount of venture capital investments made in businesses primarily founded by diverse founding team members, expressed as a percentage of total venture capital investments, also broken down by demographic category.

Under the FIPVCC, a "diverse founding team member" means a founding team member who self-identifies as a woman, nonbinary, Black, African American, Hispanic, Latino/Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran or disabled veteran, lesbian, gay, bisexual, transgender, or queer. A business is "primarily founded by diverse founding team members" if more than one-half of the founding team members responded to the survey and at least one-half of the founding team members are diverse founding team members.

Venture Capital Investment Data

The report must additionally include the total amount of money invested by the covered entity in venture capital investments in each business and the principal place of business of each company in which such covered entity made a venture capital investment during the prior calendar year.

The Survey Process

Covered entities must obtain the required demographic data by distributing the standardized survey form published by the DFPI to all founding team members of businesses in which the covered entity made venture capital investments during the preceding calendar year. The DFPI has now made available both the survey form and the reporting form on its website.

Several procedural requirements apply to the survey process:

• Covered entities may only provide the survey after the covered entity has executed an investment agreement with the business and made the first transfer of funds.
• Covered entities must provide written disclosures to each founding team member prior to, or concurrently with, the distribution of the survey stating that: (1) disclosure is voluntary, (2) no adverse action will be taken if the founding team member declines to participate, and (3) the aggregate data collected for each demographic category will be reported to the DFPI.
• Covered entities may not in any way encourage, incentivize, or attempt to influence the decision of a founding team member to participate in the survey.
• The survey must include a "decline to state" option for each question.

Covered entities must collect and report survey response data in a manner that does not associate any such data with any individual founding team member. The DFPI is required to make the reports submitted by covered entities readily accessible, easily searchable, and easily downloadable on its website.

Consolidated Reporting for Commonly Controlled Entities

Covered entities that are commonly controlled can satisfy their reporting obligations by providing a combined report, including the requisite reporting information for all such covered entities, prepared by the business that controls each covered entity. This allows fund managers to file a single report on behalf of all in-scope funds they manage, rather than making separate filings for each individual fund.

Recordkeeping Requirements

Covered entities must maintain records related to their obligations under the FIPVCC for at least five years after the delivery of the corresponding report to the DFPI. Such records may be examined by the DFPI for compliance purposes.

Fees and Penalties

The fee for submitting each report will be at least $175. If a covered entity fails to file a report by April 1 of any calendar year, the DFPI will issue a written notice allowing the covered entity to file the report within 60 days without penalty. If the company fails to submit the report within this 60-day grace period, the DFPI is entitled to enforce the law by filing in court to compel compliance and to impose a penalty sufficient to deter non-compliance.

The monetary penalty shall not exceed $5,000 per day for each day that a violation continues, unless the violation is reckless or knowing, in which case the Commissioner can determine that a penalty exceeding $5,000 should be applied. In determining the appropriateness of a penalty, mitigating factors include the financial standing of the covered entity, the number of assets under management, the nature of the failure to comply, the financial resources available to the covered entity, and the covered entity's history of previous violations. Continued noncompliance may also result in enforcement actions, cease and desist orders, and recovery of costs and attorney's fees.

Privacy Considerations

The demographic data required (race, ethnicity, gender identity, sexual orientation, disability, and veteran status) qualifies as "sensitive personal information" under the California Consumer Privacy Act (CCPA) and "special category data" under the General Data Protection Regulation (GDPR), both subject to heightened safeguards. Despite anonymized collection and reporting, collecting this information constitutes processing of personal data at the point of collection. Venture capital firms should perform a risk assessment balancing the legal obligation to report against potential impacts on individuals, and confirm appropriate safeguards (voluntariness, aggregation, de-identification) and record-retention periods are in place.

Practical Recommendations

With the April 1, 2026, reporting deadline rapidly approaching, venture capital firms should:

• Determine coverage. Confirm which entities are covered entities under the FIPVCC. Note that the analysis must be conducted at the individual vehicle level, not the advisor level. Managers will need to analyze which vehicles they advise are covered entities under the law.
• Register immediately with the DFPI. If not yet registered, complete registration through the VCC Reporting Program portal without delay, as the March 1 deadline has passed.
• Identify founding team members. Identify all founding team members of portfolio companies in which any covered entities made a venture capital investment in 2025.
• Distribute surveys. Distribute the DFPI standardized survey to each founding team member, along with the required written disclosures.
• Complete surveys immediately. With the April 1 deadline approaching, covered entities should prioritize distributing surveys to founding team members of 2025 portfolio companies and collecting responses without delay.
• Complete and submit the report. Complete the DFPI report for 2025 and submit via the DFPI's online portal by April 1, 2026. This deadline is less than one month away.
• Retain records. Retain records relating to each report for at least five years.
• Address privacy considerations. Review privacy policies and data security policies before collecting founder information to ensure sufficient disclosures; ensure surveys include clear written notices and "decline to state" options; document a risk assessment for sensitive data processing; and rely on the legal-obligation exception under applicable privacy laws to support the required collection, use, and disclosure of this information.
• Implement best practices. To mitigate potential litigation risk, implement practices that demonstrate demographic data plays no role in investment decisions and is collected solely for compliance purposes. Venture Capital firms should design their systems for requesting demographic data from portfolio companies such that surveys occur only after making the investment decision and are clearly voluntary.

We will continue to monitor developments with respect to the FIPVCC and provide updates as additional guidance becomes available from the DFPI. Please contact Chris Sloan, Robert H. Laird Jr., Emily Strack, or Omkar Mahajan if you have any questions about the new requirements or need assistance with compliance.