The DFPI suspended the FIPVCC two weeks before the April 1 deadline, but the law is still on the books, and the rulemaking that follows could be harder to work around than the original.
If you're a fund manager, founder, or LP with any connection to California's venture capital ecosystem, you probably spent the last three months trying to figure out whether you needed to register with the state's Department of Financial Protection and Innovation and start collecting demographic data on your portfolio companies' founding teams.
You can stop rushing. But you shouldn't stop working.
On March 17, the DFPI announced that it's suspending implementation and enforcement of the Fair Investment Practices by Venture Capital Companies Law (the FIPVCC, originally enacted as SB 54 in 2023 and amended by SB 164 in 2024). The April 1 reporting deadline is on hold, and the DFPI says it won't require further registrations either. The stated reason: the agency plans to initiate formal rulemaking "with the goal of promoting clarity, collaboration, and transparency."
Translation: the law as written raised too many questions for too many firms, and the DFPI blinked before the compliance stampede turned into a litigation stampede.
But here's what matters: the FIPVCC hasn't been repealed. It hasn't been struck down. California Corporations Code sections 27500 et seq. are still law. What's suspended is enforcement, not the statute. And when rulemaking wraps up (the DFPI says within a year of initiation), the reporting requirements will come back. Probably with clearer definitions and fewer escape routes.
What happened
The law California built (and then couldn't enforce)
The FIPVCC started as SB 54, signed into law in October 2023. The concept was straightforward: require venture capital firms operating in California to collect and report anonymized demographic data about the founding teams of their portfolio companies. The goal was transparency into whether VC dollars were reaching diverse founders.
In 2024, the legislature passed SB 164, which repealed SB 54 and replaced it with a refined version codified at California Corporations Code sections 27500 et seq. The amendments pushed the compliance timeline to 2026 and tightened some definitions, but kept the core mandate intact.
Under the FIPVCC, covered entities had two deadlines:
- March 1, 2026: Register with the DFPI by submitting entity name, contact information, and website details.
- April 1, 2026: File the first annual report, covering demographic data from investments made in calendar year 2025.
Both are now suspended.
Why the DFPI hit pause
The DFPI didn't offer a detailed explanation, but the context tells the story.
Start with the law's scope. It's genuinely unclear. The FIPVCC defines a "venture capital company" using three alternative tests drawn from SEC and ERISA frameworks, then layers on a four-prong California nexus test so broad that a New York-based fund with one California LP could be covered. Family offices, exempt reporting advisers, internally managed vehicles: all potentially in scope. Multiple firms submitted comment letters to the DFPI asking basic questions. Are we covered? Which entity in our fund structure needs to register? The DFPI's own guidance couldn't resolve all of them.
Then there's the federal headwind. In January 2025, Executive Orders 14151 and 14173 revoked prior DEI-related executive actions and directed federal agencies to eliminate DEI programs and offices. Federal contractors now face certification requirements emphasizing merit-based decision-making. A California law mandating demographic data collection by VC firms sits in direct tension with a federal policy discouraging exactly that. No formal preemption challenge has been filed yet. But the political crosswinds were real enough to give any regulator pause.
And industry pushed back hard. Groups including the National Venture Capital Association pressed for a postponement in the weeks before the deadline, citing the compressed timeline and unresolved interpretive questions. The DFPI's own announcement referenced "comments by various stakeholders" as the catalyst for its rulemaking decision. The agency listened.
What this law actually requires (when it comes back)
Understanding what was suspended matters just as much as knowing it was suspended. When rulemaking concludes, here's what you'll face.
Who's covered
A "covered entity" must satisfy two tests:
Test 1: You're a venture capital company. That means you meet at least one of three criteria:
- At least 50% of your assets (excluding short-term holdings) are "venture capital investments" in operating companies where you have management participation or influence rights
- You qualify as a "venture capital fund" under SEC Rule 203(l)-1 (80% of capital committed to nonpublic equity)
- You qualify as a "venture capital operating company" under ERISA
AND you primarily engage in investing in or financing startup, early-stage, or emerging growth companies.
Test 2: You have a California nexus. Any one of four prongs triggers coverage:
1. Headquartered in California
2. Significant presence or operational office in the state
3. Making venture capital investments in California-based businesses or businesses with significant California operations
4. Soliciting or receiving investments from a California resident
Prongs 3 and 4 are the ones causing heartburn. There's no minimum threshold for either. A single California portfolio company or a single California LP could, under a plain reading of the statute, make your fund a covered entity. That breadth is likely what the rulemaking will need to address.
What you'd need to report
Covered entities must annually file anonymized, aggregated demographic information about the founding team members of every company they invested in during the prior calendar year. The statute defines "founding team member" as either: (a) someone who owned initial shares, contributed to the concept or development before shares were issued, and wasn't a passive investor, or (b) the person designated as CEO or president.
The demographic categories:
- Gender identity (including nonbinary and gender-fluid identities)
- Race
- Ethnicity
- Disability status
- LGBTQ+ identification
- Veteran or disabled veteran status
- California residency
- Whether any founding team member declined to provide information
Participation by founding team members is voluntary. Covered entities can't encourage, incentivize, or try to influence responses. Data must be stored as sensitive personal information with restricted access for a mandatory five-year retention period.
Penalties (currently suspended)
Noncompliance triggers a 60-day notice-and-cure period. After that, civil penalties of up to $5,000 per day, with higher amounts for reckless or knowing violations. The DFPI can also seek injunctive relief and recover its costs and attorneys' fees. Each report carries a minimum $175 filing fee.
What it means for your business
The suspension is tactical relief, not a victory
If you're reading this as "problem solved," you're making the same mistake companies made when the SEC delayed its climate disclosure rules. The delay bought time. It didn't change the destination.
Here's why the rulemaking could produce something harder to work around than the original statute.
Right now, the ambiguity in the nexus tests gives firms a colorable argument for non-coverage. Once the DFPI defines "significant presence" and sets thresholds for how many California LPs or portfolio companies trigger coverage, the gray area shrinks. Firms that were relying on interpretive uncertainty lose that cushion.
There's also the comment process to think about. The DFPI has committed to seeking input from "venture capital companies, industry associations, founders, investors, and other relevant parties." Good. But advocacy groups and legislators who pushed for SB 54 in the first place will weigh in too. The final rules won't just reflect industry preferences.
And the political dynamics cut both ways. The federal anti-DEI executive orders create tension, but California has shown no appetite for retreating on transparency mandates. The suspension was about implementation mechanics, not about Sacramento reconsidering whether this data should be collected at all.
The federal-state squeeze
If you're a fund manager with federal contracting relationships, or portfolio companies that are federal contractors, you're caught between competing signals. California wants you to collect demographic data. Washington is discouraging DEI-related data collection.
The practical path through this: structure your demographic survey process so it's clearly post-investment, clearly voluntary, and clearly firewalled from investment decision-making. Document that investment decisions are merit-based. If your data collection process can't survive scrutiny from both Sacramento and Washington, fix it now while you have the runway.
Scope is the battleground
The rulemaking will almost certainly address the California nexus test. This is where the real stakes are.
If the DFPI narrows the nexus to firms headquartered in California or with significant operations there, coverage shrinks dramatically. If they keep the current broad reading (one LP, one portfolio company), then fund managers in New York, Boston, and Austin with any California touchpoint are in scope.
If I were advising a fund, I'd want to know the answer to one question right now: under any reasonable interpretation of the nexus test, could we be a covered entity? If the answer is "maybe," the rulemaking comment period is your chance to influence the answer. If the answer is "definitely yes," you should be building your compliance infrastructure now.
Practical takeaways
Here's what to do with the pause:
1. Audit your California nexus exposure this month. Map every California LP, every California-headquartered portfolio company, and every California office or employee. Know which prongs of the nexus test you might trigger. This analysis doesn't change regardless of what the rulemaking produces.
2. Don't dismantle compliance work already in progress. If you've started building a demographic survey process or evaluating third-party survey tools, keep going. The reporting requirement will come back. Firms that built infrastructure during the pause will be months ahead when the new deadline drops.
3. Track the rulemaking timeline and participate. The DFPI says it will seek input before commencing formal rulemaking. When the comment period opens, submit comments. This is where the nexus test, entity definitions, and practical mechanics will get decided. If you're a fund manager affected by overbreadth concerns, your voice matters here.
4. Brief your legal team on the federal-state tension. If any of your portfolio companies are federal contractors, or if your fund has federal contracting relationships, you need a clear internal policy on how demographic data collection complies with both the FIPVCC (when it returns) and Executive Orders 14151/14173. Get this mapped before you're under deadline pressure.
5. Review your LPA and side letter provisions. Some LPs may have negotiated reporting commitments that reference California's diversity disclosure requirements. If those provisions are tied to the FIPVCC specifically, the suspension may pause your contractual obligations too. If they reference "applicable law" more broadly, you may still have reporting duties under other frameworks.
6. Designate a compliance owner now. Whether it's your CCO, fund counsel, or an outside compliance consultant, assign someone to own this. The rulemaking process will move in stages, and someone needs to track each stage and flag when action is required.
7. If you're a founder, understand what's coming. When the FIPVCC returns, the VC firms investing in your company will send you a demographic survey. Participation is voluntary, and the law prohibits retaliation for declining. But you should understand what data is being requested, who will see it (only aggregated data goes to the DFPI), and how it will be stored. Knowing the framework helps you make an informed decision when the survey arrives.
What we're watching
DFPI stakeholder input phase. The DFPI says it will engage with industry before commencing formal rulemaking. Watch for announcements of listening sessions or informal comment opportunities later in 2026.
Formal rulemaking initiation. Once the DFPI begins formal rulemaking, it has one year to finalize regulations. The clock on the new compliance deadline starts here.
Federal preemption challenges. No court has ruled on whether the federal anti-DEI executive orders preempt state-level demographic reporting mandates. A legal challenge could change the calculus entirely.
Other states. California is first, but it won't be the last state to consider VC diversity reporting. Watch for similar bills in New York, Illinois, and Massachusetts.
NVCA model compliance framework. The NVCA may develop standardized survey templates and compliance guidance during the rulemaking window. If they do, adopting their framework early could simplify your eventual compliance.
The DFPI gave the industry a breather. That's real. But the firms that treat this as a permanent reprieve will be the ones scrambling when the rulemaking wraps and a new deadline lands. You've got a window to build your compliance infrastructure, map your exposure, and shape the final rules through the comment process. Use it.
This article is for informational purposes only and does not constitute legal advice. Every company's situation is different, and you should consult with qualified legal counsel before making compliance decisions based on the developments discussed here.
If your fund is trying to determine whether the FIPVCC applies to you, or if you need help building a compliant demographic survey and reporting process, that's exactly the kind of regulatory preparation an Outside General Counsel helps you get right before the deadline arrives.