California Fair Investment Practices by Venture Capital Companies Law: Key Amendments, DFPI Oversight, and 2026 Reporting Deadlines

This alert is a follow-up to our October 2023 client alert regarding California Senate Bill (SB) 54, which was subsequently repealed and replaced by California SB 164, aka the Fair Investment Practices by Venture Capital Companies (FIPVCC) Law.

As previously reported, the FIPVCC creates a venture capital transparency regime requiring many asset management firms that have a California nexus to collect and publicly report aggregated demographic information regarding the founding teams of the portfolio companies in which they invested during the preceding year. The broad language of the FIPVCC means that it may capture (i) “covered entities” that are not traditional “venture capital” firms or funds and (ii) funds of an asset manager without a physical office or personnel in California and funds without any California-based portfolio companies (for example, if they solicit or accept capital from any California resident investor).

SB 164 transferred administration and enforcement under the FIPVCC from the California Civil Rights Department to the California Department of Financial Protection and Innovation (DFPI). As of the date of this alert, the DFPI’s website with respect to the FIPVCC notes that the registration portal and reporting process are currently under development and will be made available prior to the stated deadlines. Covered entities should continue to monitor the DFPI website for updates.

Which Entities Need to Comply?

The FIPVCC applies to a “covered entity,” which is defined as a “venture capital company”¹ that:

• Primarily engages in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies; and
• Has a California nexus,² meaning it satisfies at least one of the following:
  (i) It is headquartered in California.
  (ii) It has a significant presence or operational office in California.
  (iii) It makes venture capital investments in businesses located in, or with significant operations in, California.
  (iv) It solicits or receives investments from a person who is a resident of California.³

SB 164 removed the prior alternative prong of the definition of covered entity that was included in SB 54, which could have captured entities that “manage assets on behalf of third-party investors” even if they were not primarily engaged in venture investing. As a result, SB 164 is more clearly focused on venture capital funds and other vehicles that meet the DFPI/California regulatory definition of “venture capital company.” That being said, regardless of a fund’s stated strategy, if the fund acquires securities of an operating company in which the adviser has management rights and/or participates in the management of the business of the operating company (including through a board or board observer seat), such fund likely would be covered by the definition and could be subject to the reporting requirements.

Information Required and Deadlines for Compliance

1. Entity-Level Submission (Due March 1, 2026)

Commencing March 1, 2026, each covered entity must submit certain identifying and contact information (including (i) the covered entity’s name; (ii) the name, title, and email address of the covered entity’s designated point of contact; and (iii) the covered entity’s designated email address, telephone number, physical address, and website) to the DFPI in a manner prescribed by the DFPI.

Covered entities must keep this information updated, including through the submission of updates when filing their annual reports.

As previously noted, as of the date of this alert, the DFPI has not yet provided a way to register or submit this identifying information. Covered entities should continue to monitor the DFPI website for further updates.

2. Annual Report (First Due April 1, 2026)

No later than April 1, 2026, and annually thereafter, each covered entity must report specified information regarding its venture capital investments made during the prior calendar year. The annual report includes information relating to:

• Founding team demographic information. At an aggregated level (and only to the extent provided by founders in response to the required survey), the covered entity must report demographic information (i.e., gender identity including nonbinary and gender-fluid identities; race; ethnicity; disability status; LGBTQ+ identification; veteran or disabled veteran status; California residency; and whether any founding team member declined to provide any of the foregoing information) for each “founding team member”⁴ of each business in which the covered entity made a venture capital investment in the prior calendar year.
• “Diverse founder ” investment metrics. The report must also include, for the prior calendar year, both (i) the number of venture capital investments in businesses primarily founded by “diverse founding team members,”⁵ expressed as a percentage of the covered entity’s total number of venture capital investments in the aggregate and broken down across the demographic categories, and (ii) the total amount of venture capital investments to businesses “primarily founded by diverse founding team members,” expressed as a percentage of the covered entity’s venture capital investments, again in the aggregate and broken down across the demographic categories listed.⁶
• Investment-level information.⁷ In addition to aggregated demographic metrics, the covered entity must report (i) “the total amount of money in venture capital investments the covered entity invested in each business during the prior calendar year” and (ii) “the principal place of business of each company in which the covered entity made a venture capital investment during the prior calendar year” (FIPVCC).

As of the date of this alert, the annual reporting form is accessible (even though the DFPI website landing page still shows the reporting form as “coming soon”). Covered entities should continue to monitor the DFPI website for further updates.

Survey Process, Founder Notices, and Anonymization Requirements

The FIPVCC requires covered entities to obtain founder demographic information by offering each founding team member of a portfolio company the opportunity to complete a survey on a standardized form specified by the DFPI.

The FIPVCC includes guardrails intended to reduce pressure on founders and mitigate privacy concerns. Among other requirements, neither the covered entity nor the DFPI may encourage, incentivize, or attempt to influence a founding team member’s decision whether or not to participate in the survey, and covered entities must collect and report survey data in a manner that does not associate survey responses with any individual founding team member. The published survey also includes a statement noting that (i) a “founding team member’s decision to disclose demographic information is voluntary,” (ii) “no adverse action will be taken against a founding team member” who declines to participate in the survey, and (iii) only aggregated and anonymized data collected for each demographic category will be reported to the DFPI.

A covered entity may not provide the survey or such written disclosure until after it has “executed an investment agreement with the business and made the first transfer of funds.”

DFPI Publication, Fees, Penalties, Record Retention Obligations, and Oversight/Enforcement

Public Availability of Reports

The DFPI is required to make the reports submitted by covered entities readily accessible, easily searchable, and easily downloadable on its website, and it may also publish aggregate results or aggregate information based on the information it receives.

Fees

The DFPI is required to charge and collect fees from covered entities to cover the costs of administering the program. The fee per report must be at least $175, and the DFPI may adjust the fee as necessary to meet the reasonable costs of administration.

Record Retention and Examinations

Covered entities must maintain records related to their reporting obligations and preserve records related to a delivered report for at least five years. The DFPI has the authority to examine records to assess compliance and can require production of documents and written reports/answers.

Enforcement and Cure Periods

If a covered entity fails to file the annual report by April 1 of any year, the DFPI is required to provide notice to the covered entity and allow a 60-day period to submit the report without penalty. Similar notice-and-cure mechanics apply to failures to timely update entity-level information.

If noncompliance continues after the applicable cure period, the DFPI may pursue remedies, including seeking injunctive relief. The FIPVCC also authorizes civil penalties up to $5,000 per day (with increased penalties for reckless or knowing violations).

Practical Steps to Take Now

Although the DFPI is expected to provide additional implementation guidance, covered entities can take several steps now to position themselves for timely compliance:

• Confirm coverage. Evaluate whether each fund/vehicle (and/or its manager) meets the “venture capital company” definition and the “covered entity” criteria, including the California nexus test.
• Identify the reporting structure. Assess whether reporting will be done at the fund level or via a controlling entity report covering multiple covered entities, and map which investments will be captured.
• Build a 2025 investment-tracking workflow. Because the first report will cover 2025 investments, ensure internal compliance systems capture (i) the amounts invested per portfolio company and (ii) each portfolio company’s principal place of business.
• Update deal process and templates. Prepare to integrate the DFPI survey and the required founder disclosures into post-closing workflows (consistent with the FIPVCC’s timing restrictions), and coordinate with portfolio companies regarding distribution and collection mechanics.
• Implement privacy and data governance controls. Treat founder demographic information as sensitive personal information, and ensure anonymization and record-retention requirements can be satisfied. Since the FIPVCC requires anonymized reporting, covered entities should consider using a third-party survey tool that aggregates data before it reaches the deal team. Covered entities should also ensure that internal records of individual responses are kept in a restricted-access folder for the mandatory five-year retention period.
• Monitor DFPI guidance. Watch the DFPI’s website for release of its registration portal, FAQ, and any interpretive guidance on open terms.

Potential Challenges and Broader Context

As with other California diversity-related initiatives, the FIPVCC’s implementation and enforcement has drawn scrutiny. However, unlike California’s prior broad diversity mandates, the FIPVCC is disclosure-focused and does not require any firm to make investments based on founder demographics. Nevertheless, firms should continue to monitor legal developments affecting diversity, equity, and inclusion and data-collection mandates and consider how investors, founders, employees, and other stakeholders may view public reporting.

Goodwin will continue to monitor the DFPI’s implementation of the FIPVCC and will provide additional updates if there are any material changes.