California’s New Investor Reporting Law: Considerations for Institutional Investors

The California Fair Investment Practices by Venture Capital Companies Act (the FIPVCC, Cal. Corp. Code § 27500 et seq.) imposes new reporting, recordkeeping, and transparency requirements on investment firms with a significant nexus to the state.

The law aims to increase public transparency regarding the demographics of the founding teams of businesses receiving investment, with a particular focus on diversity. Subject entities must begin annually reporting – commencing March 1, 2026 – demographic data of the companies they fund, maintaining records, and complying with oversight by the California Department of Financial Protection and Innovation (the DFPI). The statute provides robust enforcement mechanisms, including penalties for noncompliance and formal procedures for investigations and hearings.

This GT Alert provides a practical overview of the obligations, scope, and potential downstream implications for both investors and the funds or companies in which they invest.

Executive Summary

The FIPVCC requires certain private investment funds (known as covered entities) that invest in startup, early-stage, or emerging growth companies and have a California nexus to register with the DFPI and to report, on an annual basis, anonymized, aggregated demographic data about the founding teams of their portfolio companies. The DFPI then makes these reports publicly available.

To Whom Does the Law Apply?

The FIPVCC imposes reporting obligations on covered entities. The law considers an entity a covered entity if it:

• is a “venture capital company”;
• primarily invests in or finances startup, early-stage, or emerging growth companies; and
• has a California nexus.

A venture capital company is any entity that meets at least one of the following conditions:

• on at least one occasion each year, at least 50% of its assets (valued at cost, and other than short-term investments pending long-term commitment or distribution) are “venture capital investments”¹ or “derivative investments;”²
• the entity qualifies as a “venture capital fund” under SEC rule 203(l)-1;³ or
• the entity qualifies as a “venture capital operating company” under DOL rule 2510.3-101(d).⁴

An entity has a California nexus if it:

• is headquartered in California;
• has a significant presence or operational office in California;
• makes venture capital investments in businesses that are located in, or have significant operations in, California; or
• solicits or receives investments from a California resident.

Thus, a California office, a single California investor, or even the mere solicitation of a California resident may be sufficient to create nexus. The state has not yet clarified what makes a California presence “significant.”

What Information Needs to Be Reported? 

Covered entities must report, in aggregate, demographic information about the founding teams of startups they funded in the previous calendar year. The law requires reporting of (i) gender identity; (ii) race and ethnicity; (iii) disability status; (iv) LGBTQ+ identification; (v) veteran or disabled veteran status; and (vi) California residency. Covered entities must collect the information via a voluntary survey (with a “decline to state” option), and the process must preserve individual privacy.

Additionally, reports must show the number and percentage of investments made in companies primarily founded by “diverse” founding team members (as defined in the statute), as well as the total dollar amount and percentage of capital invested in such companies. Covered entities must also report the total amount invested in each company and the principal place of business of each portfolio company. The DPFI will publish the reports, making them publicly accessible.

What is the Effective Date of the New Law?

Covered entities must register with the DFPI by March 1, 2026, and file their first annual report covering the prior year’s investments by April 1, 2026 (and annually thereafter).

What are the penalties for noncompliance?

Failure to comply with the FIPVCC may result in substantial and escalating penalties.

• Monetary Penalties

General violations are subject to penalties of up to $5,000 per day for each day the violation continues.  For reckless or knowing violations, the penalty may exceed $5,000 per day, in an amount “sufficient to deter” noncompliance, as determined by the DFPI commissioner. The commissioner considers mitigating factors, such as financial standing, assets under management, the nature of the violation, and prior history, when setting penalty amounts.

• Remedial Orders

The DFPI may issue orders to desist and refrain from further violations, require payment of investigation and legal costs, and impose monetary penalties.

• Cure Period

If a report is late or incomplete, the DFPI will provide a 60-day window to cure the deficiency without penalty. If the entity fails to comply after this period, penalties may accrue and the DFPI may pursue all available remedies.

• Judicial Enforcement

If a covered entity does not comply with an order, the commissioner may seek court enforcement. Courts may hold the entity in civil contempt and impose further civil penalties.

Does the Law Apply to More Than Traditional Venture Capital Funds?

Yes; the FIPVCC’s definition of a venture capital company is broader than the traditional concept of venture capital. Growth equity, crossover, and certain early-stage private equity funds may be subject to the law if their assets are primarily in qualifying venture capital investments. The law applies based on the substance of the fund’s activities and structure, not its marketing label. Real estate and traditional buyout funds may generally be excluded, unless they invest in operating companies with management rights and a startup or early-stage focus.

Does the Law Impact LPs in Funds?

No, not directly. The reporting, registration, and compliance obligations fall on the fund/manager (the covered entity), not on LPs. LPs do not have to provide demographic data, file reports, or register.

Noncompliance by a fund may affect returns (if penalties are levied), or reputation (since reports are public). Some LPs may face questions from their own stakeholders about their exposure to non-compliant funds.

Is Information About LPs Disclosed?

No; the public reporting obligation relates only to portfolio company founding teams, not to the fund’s investors. The only circumstance in which an LP’s identity is relevant is for determining whether a fund has a California nexus (i.e., whether it is a covered entity in the first place). However, DFPI does not publicly disclose this detail.

What Should LPs Require in Side Letters?

It may be prudent to confirm with managers whether funds that are potentially treated as “covered entities” are aware of this new law and have a gameplan for compliance. However, depending on the circumstances, seeking affirmative covenants for observance of the new rules may be unnecessary. General partners may refuse such requests, because some of them resist general “compliance with law” obligations.

Still, investors may consider requesting prompt notification if the manager receives any notice of investigation, enforcement, or penalty from the DFPI, and (if helpful) access to (or copies of) the annual, anonymized report submitted to the DFPI (to the extent permitted by law). As public reports accumulate, stakeholders – including institutional investors, advocacy groups, and the press – may use the data to benchmark fund performance on diversity, potentially influencing fundraising, reputation, and portfolio company selection.

Likewise, institutional investors may see more requests for information during due diligence, as funds seek to confirm that their investors do not trigger the California nexus or to clarify whether their investment strategies are in or out of scope.

What About Direct Investments in Operating Companies? 

If an institutional investor makes a direct investment into an operating company (and not via a fund), the FIPVCC does not require those investors to register or report unless the investor itself meets the definition of a covered entity. For example, a sovereign wealth fund, a family office, or a corporate venture arm running a structured venture capital program may become a covered entity if it meets the criteria.

The law generally does not apply to operating companies (i.e., portfolio companies themselves) unless, in an unusual scenario, those companies are structured as venture capital companies making qualifying investments. Their only role under the law is to voluntarily respond to demographic surveys sent by covered entities after an investment.

Practical Compliance Considerations

Covered entities should consider reviewing their onboarding, investment, and recordkeeping workflows to ensure demographic surveys are distributed, completed, and stored in accordance with the statute’s privacy and timing requirements. Covered entities may also benefit from proactively engaging with the DFPI or industry groups regarding implementation, FAQs, and interpretations, especially as the agency issues new rules and guidance.

Collecting sensitive demographic data creates potential data privacy and cybersecurity risks. Funds may wish to review their data security policies and vendor agreements (especially if outsourcing survey administration or reporting). While the FIPVCC requires covered entities to report demographic data in aggregate and anonymized form, the statutory requirement to disclose investment amounts and principal place of business for each portfolio company may allow third parties to cross-reference public information (e.g., press releases, websites, etc.) and deduce which demographic data relates to which company. This potential for de-anonymization might raise reputational and public relations risks for both funds and their portfolio companies, particularly those sensitive to public perception of their diversity statistics or those operating in stealth mode.

Moreover, the FIPVCC’s public reporting obligations include company-level investment amounts and principal place of business, which may be accessible through DFPI’s website. Accordingly, companies that wish to keep their fundraising confidential may find their investment amounts and other identifying information disclosed, regardless of their own public communications strategy. This might have consequences for competitive positioning, negotiation leverage, and strategic planning. Covered entities and portfolio companies should consider how they plan to manage these disclosures and their potential downstream impacts.

Finally, other states or federal agencies may look to California’s model as a template, raising the possibility of broader, multi-jurisdictional reporting requirements in the future.

Potential Action Items

This checklist of suggestions to help enhance compliance with the new law is intended primarily for funds, managers, and general partners who may be subject to the FIPVCC and outlines actions they may wish to take. However, institutional investors acting as LPs or passive investors may also consider these action items to better understand their managers’ obligations and to inform their own due diligence, risk assessment, and potential side letter requests.

• Determine Applicability — Assess whether the fund, manager, or direct investment vehicle qualifies as a venture capital company and meets covered entity requirements, particularly California’s nexus criteria.
• Establish Reporting Framework — Decide whether to report at the individual fund/entity level or to consolidate multiple entities under a controlling entity report. Map which portfolio investments fall within reporting scope.
• Set Up Investment Tracking for 2025 — Since initial reporting covers 2025 investments, implement systems to capture (i) investment amounts per portfolio company, and (ii) each company’s principal place of business.
• Register with the DFPI — Register as soon as the registration portal is open and no later than March 1, 2026.
• Distribute Surveys — Distribute the DFPI’s standardized survey (VCC Demographic Data Survey) to founding team members of applicable venture capital investments.
• Revise Transaction Processes — Incorporate the DFPI demographic survey and mandatory founder disclosures into post-closing procedures, following the law’s timing requirements. Coordinate with portfolio companies on survey distribution and collection.
• Track Regulatory Developments — Monitor the DFPI website for the registration portal launch, FAQs, and interpretive guidance on implementation details.

For LPs and passive investors, consider requesting from managers (i) notification of DFPI enforcement actions or investigations; (ii) access to anonymized annual reports (as permitted by law); and (iii) confirmation of compliance planning for FIPVCC.

Key Takeaways

Institutional investors may wish to assess whether their existing or prospective fund investments and direct investments may be subject to the FIPVCC. Understanding the law’s broad reach, the nature of reportable investments, and the potential operational and reputational risks associated with noncompliance may prove important for investors across the state. 

• The FIPVCC has a broad reach— Any fund, investment vehicle, or direct investor with a California investor or portfolio company may be in scope, regardless of domicile or traditional strategy label.
• LPs in funds are not directly regulated — However, they may wish to remain attentive to compliance risks at the fund level and may consider targeted side letter provisions for compliance comfort and transparency.
• Direct investors may be in scope — Direct investors in operating companies may be in scope if their activities mimic those of a venture capital company.
• Noncompliance may be costly and public — Penalties may be significant, and the public nature of enforcement actions raises potential reputational risk concerns.

While California enacted the FIPVCC with the goal of increasing diversity and transparency in venture investing, its broad reach and corresponding penalties mean that even investors and funds far outside California’s borders may be affected. Accordingly, institutional investors may wish to treat compliance as a dynamic process, integrating FIPVCC awareness into ongoing manager diligence, risk management, and fund governance protocols.

1 A “venture capital investment” is an acquisition of securities in an operating company (i.e., a company that produces or sells goods/services, not just invests capital), where the investor (the fund or its adviser) obtains “management rights.” Management rights are contractual or ownership rights that allow the investor to substantially participate in, influence, or provide significant guidance to the management, operations, or business objectives of the company.

2 A “derivative investment” is an acquisition of securities by a venture capital company in the ordinary course of its business in exchange for an existing venture capital investment, either (i) upon exercise or conversion of the original investment (e.g., convertible notes or options); or (ii) in connection with a public offering, merger, or reorganization of the operating company to which the original investment relates. 

3 A “venture capital fund” under this rule is a private investment fund that meets a strict set of criteria designed to ensure the fund’s primary business is investing in private, early-stage companies (i.e., the classic venture capital model), with limited leverage and investor withdrawal rights.

4 A “venture capital operating company” (VCOC) is a concept under the Employee Retirement Income Security Act (ERISA) rules, which governs whether the assets of certain investment funds are considered “plan assets” (i.e., assets of ERISA-regulated retirement plans). To avoid being treated as holding “plan assets,” and thus being subject to fiduciary obligations, a fund may qualify as a VCOC by meeting specific tests.