Part III: Practical Compliance – What You Should Be Doing Now
California’s new Fair Investment Practices by Venture Capital Companies Law (FIPVCC) is shaking up the Venture Capital (VC) industry with its first compliance deadlines are right around the corner. In Part I of our blog series, we discussed applicability and who is covered. In Part II, we covered comprehensive compliance requirements. In Part III of our blog series, we’re focusing on practical, near-term compliance. In other words, what should VC firms be doing now to get compliant and stay compliant.
Key Takeaways
- Covered entities should start, if they haven’t already, gathering their 2025 data to meet the first FIPVCC annual report submission deadline of April 1, 2026. Covered entities should use the DFPI VC Demographic Data Survey template.
- Covered entities should begin building out compliance programs to gather, track, and report the relevant demographic data, keeping in mind that the VC Demographic Data Survey cannot be sent until after it has “executed an investment agreement with the business and made the first transfer of funds.”
- Covered entities will need to evaluate their other compliance frameworks in light of the FIPVCC including policies related to record retention as well as data privacy and information security as founder demographic data includes sensitive personal information.
Determine Applicability
See Part I in our blog series for more detail but, generally, you can determine if you (or each fund/vehicle and/or its manager) are a covered entity under the FIPVCC by answering the following questions:
1. Are you a “venture capital company”?[1]
If yes, move on to question 2. If no, you are not a “covered entity.”
2. Do you primarily engage in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies?
If yes, move on to question 3. If no, you are not a “covered entity.”
3. Do you meet any one of the following criteria – i.e., have a California nexus?
- You are headquartered in California;You have a significant presence or operational office in California;You make venture capital investments in businesses that are located in, or have significant operations in, California; or
- You solicit or receive investments from a person who is a resident of California.
If yes, you are a “covered entity.” If no, you are not a “covered entity.”
Kick off Your Compliance Program
Covered entities must provide an annual VC Demographic Data Report to the DFPI with an initial reporting deadline of April 1, 2026 whereby they must provide aggregated, anonymized data from VC Demographic Data Surveys collected from founding team members. While each covered entity should establish a compliance program tailored to the scope and complexity of its own activities and risk profile, the following are the immediate next steps every covered entity should be considering.
Step 1: Determine whether reporting under the FIPVCC will occur at the fund/vehicle level or at a controlling entity level, as appropriate.
Step 2: Identify which investments and portfolio companies are relevant for the April 1, 2026 reporting deadline.
- Once applicability is determined, a covered entity must send the surveys and report on all portfolio companies that receive funding, regardless of the portfolio company’s location or whether the particular investment in the portfolio company would necessarily meet the definition of “venture capital investment.”[2]
- Note, however, surveys may only be provided to a founding team member after the covered entity has executed an investment agreement with the business and made the first transfer of funds.
Step 3: Send the VC Demographic Data Surveys to the founding team members of the portfolio companies identified in Step 2.
Step 4: Build out initial data tracking and reporting processes.
- Ensure personnel, technology and compliance systems are assigned to track the sending and receipt of surveys from founding team members.
- Ensure personnel, technology and compliance systems are prepared to anonymize and aggregate data from the surveys in order to populate the annual VC Demographic Data Report.
- Have designated responsible for maintaining compliance and ultimately submitting a timely annual report to the DFPI.
Step 5: Build out longer term processes and controls.
- Covered entities should start tracking and maintaining data related to the amounts invested per portfolio company and each portfolio company’s principal place of business to streamline future reporting.
- Covered entities should incorporate the VC Demographic Data Survey template into deal flows, keeping in mind the timing restriction noted in Step 2.
- Covered entities should consider what if any record retention and privacy and data governance policies need to be revisited in light of the additional requirements and information implicated under the FIPVCC.
- Covered entities should continue to monitor for related regulatory updates from the DFPI.
Register with the DFPI by March 1, 2026
Don’t forget to register as a covered entity on the DFPI’s VCC Reporting Program portal, soon to be accessible via its Landing Page, by March 1, 2026.
Foley Can Help
We are tracking the FIPVCC and related DFPI updates. For any questions regarding the FIPVCC, please reach out to the authors or another member of the Foley team.
[1] As that term is defined under Cal. Code Regs. tit. 10, § 260.204.9(a)(4).
[2] “Venture capital investment,” which falls withing the definition of “venture capital company,” means an acquisition of securities in an operating company in which the investment adviser, the entity advised by the investment adviser, or an affiliated person of either has management rights and/or participates in the management of the operating company (e.g., through a board seat). Cal. Code Regs. tit. 10, § 260.204.9(a)(4)(A).