California’s statute on Fair Investment Practices by Venture Capital Companies (the “VC Diversity Law”) will come into effect in 2026, with an initial date of March 1, 2026 to self-identify as a venture capital company subject to reporting and initial substantive reports due on April 1, 2026.

The VC Diversity Law requires, in general, that venture capital companies file annual reports on the demographic profiles of founding teams of portfolio companies in which the venture capital company has invested over the prior year. The VC Diversity Law picks up a wide array of entities, including SEC-registered investment advisers, exempt reporting advisers, family offices, and internally managed vehicles, that have even minimal California contacts such as soliciting California investors.

To date, limited guidance has been released to add to our understanding of how to comply with the statute. Covered entities will need to provide the required information to the California Department of Financial Protection and Innovation (the “DFPI”).

Background

California Governor Gavin Newsom initially signed the VC Diversity Law on October 8, 2023 (the “2023 VC Diversity Law”). It required “venture capital companies” with business ties to California to file annual reports detailing (1) specified demographic data for the founding teams of all portfolio companies invested in during the prior year and (2) the aggregate amounts of investments made by the venture capital company during the prior year and investments in specified categories of portfolio companies. As we discussed in a previous Cleary Enforcement Watch post, the VC Diversity Law requires covered venture capital companies to obtain demographic data through voluntary surveys sent to each founding team member of a portfolio company that receives funding from the venture capital company.  The data, in anonymized form, will be publicly available—and searchable and downloadable—on the DFPI website. 

In June 2024, the California State Budget in Senate Bill 164 contained an updated version of the law. This version, discussed in a previous Cleary Enforcement Watch post, contained several updates to the 2023 VC Diversity Law, including revisions to the definition of “covered entity.” The updated version also delayed the initial reporting date to March 1, 2026 (from the original date of March 1, 2025), and reflected a change to the California governmental division responsible for enforcing the law from the California Civil Rights Department to the DFPI.

Covered Entities

Whether an entity constitutes a “covered entity” under the VC Diversity Law has three components, a “venture capital company” test, an investment test, and a California presence test. These components are set out in detail at the end of this note. All three tests must be satisfied for an entity to be subject to the law.

The VC Diversity Law’s reporting requirements apply to venture capital companies as opposed to advisers. As a result, the law will apply to entities that are not necessarily subject to state law reporting, such as SEC‑registered advisers and exempt reporting advisers under the Venture Capital Fund Adviser Exemption (Rule 203(l)-1) and Private Fund Adviser Exemption (Rule 203(m)-1) of the Investment Advisers Act of 1940 (the “Advisers Act”), as well as entities that are not subject to most or all provisions of the Advisers Act, such as offshore advisers and excluded advisers such as family offices and banks. 

The 2024 updates to the VC Diversity Law changed the definition of “covered entity” so that it no longer captures venture capital companies that manage third-party assets but do not “primarily engage in the business of investing in or financing startup, early-stage, or emerging growth companies.” That said, it is not clear that this change will make much practical difference—there may be very few venture capital companies that would have been considered “covered entities” under the previous definition only because of their management of third-party assets. The revised definition still contains a broad set of criteria that results in a company being subject to the reporting requirements. These criteria were not changed in the updated version of the VC Diversity Law. The law will continue to capture venture capital companies with no California nexus other than accepting or even soliciting investments from California residents, so long as the companies “primarily engage[] in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies.”

Because the presence test can be satisfied by marketing directed to a single California investor (either an entity or a natural person), in practice the presence test will likely only spare private funds that have specifically excluded all California residents from fundraising activities. California residents may of course be located in other jurisdictions at the time marketing is undertaken, so screening for such investors is likely to carry a significant compliance burden. In addition, “significant” is not defined regarding either presence or operations, and as such, will require advisers to make difficult and subjective judgments that are likely to be scrutinized by the DFPI.

A “venture capital company” is defined by reference to the California exemptions from state investment adviser registration. It includes any entity that meets any of the following requirements:

  1. on at least one occasion during the annual period commencing with the date of its initial capitalization, and on at least one occasion during each annual period thereafter, at least 50% of its assets, valued at cost, are “venture capital investments” (generally securities conveying management rights in operating companies);
  2. is a “venture capital fund” as defined in Rule 203(1)-1 under the Advisers Act, which, among other requirements, is a private fund that (a) represents to investors and potential investors that it pursues a venture capital strategy and (b) holds at least 80% of its aggregate capital contributions and uncalled committed capital, valued at cost or fair value, in equity securities of qualifying portfolio companies (generally non-public companies), tested after the acquisition of each non-qualifying investment; or
  3. is a “venture capital operating company” as defined in U.S. Department of Labor rule 2510.3-101(d) (which has generally the same meaning as (1) above).

On its face, this definition is both broad and ambiguous. For example, “venture capital strategy” for purposes of prong (2) is not defined in the Advisers Act, and prongs (1) and (3) have no requirement that an entity invest in “venture capital” investments at all (merely operating companies that grant management rights), meaning ordinary private equity funds could be captured depending on their portfolios. Prongs (1) and (3) are not limited to private fund vehicles (i.e., vehicles that rely on the 3(c)(1) or 3(c)(7) exemptions from registration under the Investment Company Act of 1940) and there is no requirement that the applicable venture capital company be an advisory client of an adviser. Single investor co-invest vehicles and AIVs are therefore in scope, as are vehicles such as business development companies and trusts that do not qualify as “private funds.” When applying the venture capital company designation, advisers will likely need to be consistent with the classification they have given an investment vehicle for purposes of reporting on Form ADV and, if applicable, Form PF. 

Required Information

Venture capital companies must report several different types of data with respect to both their portfolio companies and their investment holdings writ large.

At the portfolio company level, a venture capital company must report, at an aggregate level, for each member of the “founding team” of a portfolio company that received an investment in the prior year: (1) gender identity (including nonbinary and gender-fluid identities), (2) race, (3) ethnicity, (4) disability status, (5) whether such member identifies as LGBTQ+, (6) whether such member is a veteran or a disabled veteran, and (7) whether such member is a resident of California. The venture capital company must also report (on an anonymized basis) if any member of the founding team declined to provide any of this information. The VC Diversity Law does not specify whether team members must affirmatively decline, or whether a failure to respond by a specified deadline is sufficient.

“Founding team member” is defined as either (a) a person who has been designated as the chief executive officer or president, or (b) a person who (i) owned initial shares or similar ownership of the business, (ii) contributed to the concept of, research for, development of, or work performed by the business before initial shares were issued, and (iii) was not a passive investor in the business. Whether an individual is a founding team member will be a facts-and-circumstances determination, and in many cases advisers may face challenges in both identifying all relevant founding team members and successfully soliciting survey responses.

At the aggregate portfolio level, a venture capital company must also report, for the prior calendar year:

  1. on an anonymized basis, the number of venture capital investments to businesses “primarily founded by diverse founding team members,” as a percentage of the total number of venture capital investments the venture capital company made, both in the aggregate and broken down into the diversity categories described above;
  2. the total dollar amount of venture capital investments to businesses primarily founded by diverse founding team members in the past year, on the same bases as category (1);
  3. the total dollar amount invested in each company that is a venture capital investment during the prior calendar year; and
  4. the principal place of business of each company in which the venture capital company made a venture capital investment during the prior calendar year.

Venture capital companies are required to obtain this information in a standardized voluntary survey provided to each founding team member of a business that has received money from the venture capital company. A business “primarily founded by diverse founding team members” means a founding team for which more than half of the founding team members responded to the survey and at least half of the founding team members self‑identify as “a woman, nonbinary, Black, African American, Hispanic, Latino-Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran or disabled veteran, lesbian, gay, bisexual, transgender, or queer.” This proscribed calculation means if founders don’t respond, a venture capital company’s reporting burden will be significantly reduced, and, conversely, an adviser will not be able to report successful diversity conscious investments if founding team members do not submit survey responses.

The VC Diversity Law does not define the “principal place of business” of a business, or provide for this information to be anonymized. 

If a covered venture capital company fails to submit a report to the DFPI by April 1 of a given year, beginning in 2026, the department will notify the entity that they have 60 days to submit the report without penalty. If the company fails to submit the report within 60 days, the DFPI is entitled to enforce the law by filing in court to both compel the respondent to comply with the law and submit the report, and to pay a penalty sufficient to deter the company from failing to comply. The monetary penalty shall not exceed $5,000 per day for each day that a violation continues, unless the violation is reckless or knowing, in which case the commissioner can determine that a penalty exceeding $5,000 should be applied, if necessary to deter the covered entity from failing to comply. In determining the appropriateness of a penalty, mitigating factors include the financial standing of the covered entity; the number of assets under management by the covered entity; the nature of the covered entity’s failure to comply; the amount of financial resources available to the covered entity; and the covered entity’s history of previous violations.

The updated VC Diversity Law removed the power of the department to subpoena witnesses or compel their attendance, which was included in the 2023 VC Diversity Law. However, the DFPI will retain many of the other enforcement powers from the original version, including the ability to inspect books and records; to require the production of books, papers, correspondence, and memoranda; and to take possession of the books, records, and accounts of a covered entity.

Covered entities will need to submit to the DFPI by March 1, 2026 an initial report with information regarding entity name, individual point of contact, and contact information including address and website. Each covered entity will be required to keep the filed information up-to-date and submit any changes when filing its annual report. The first substantive report will be due by April 1, 2026.

The DFPI has released the standardized demographic survey to be provided to founding team members by regulated venture capital companies as well as a reporting form for the companies to provide the anonymized demographic data report. Of note, the data reporting form indicates that “[i]f survey responses are not received from more than half of the founding team members of a team, or less than half of surveys received for a team are from a diverse founding team member, the business is not primarily founded by diverse founding team members” for reporting purposes. Additionally, the form of the survey prevents venture capital funds from requesting the founder information on an aggregated basis from founders. The survey must be provided to each founding team member and will collect private information on an individual basis.

Under the updated VC Diversity Law, information submitted to the DFPI “shall be anonymized to the extent possible.” Absent any further explanation or guidance, it is difficult to know what position the DFPI may take in the future in assessing whether firms’ approach to anonymization of information was appropriate.

Privacy Considerations

From a data privacy perspective, the VC Diversity Law requires venture capital firms to handle and annually report to the Civil Rights Department, information that is considered “sensitive” under U.S. state privacy laws, including the California Consumer Privacy Act (the “CCPA”), and, for some firms where applicable, under the EU and UK’s General Data Protection Regulation (the “GDPR”). Specifically, the demographic data at issue (i.e., race, ethnicity, gender identity, sexual orientation, disability and veteran status) qualifies as “sensitive personal information” under the CCPA and “special category data” under the GDPR, both of which are subject to heightened safeguards under those laws. In practice, and despite the fact that the law provides that such demographic data should be collected by the covered entity and reported to the DFPI in an anonymized manner, this means that venture capital firms should limit collection of such data to what is strictly necessary to meet the law’s reporting requirements and avoid any secondary or incompatible uses. Moreover, collecting this type of information through surveys directed at individual founders constitutes processing of personal data at the point of collection, triggering enhanced transparency and individual rights obligations and, under the GDPR, requiring identification of a valid Article 9 condition (such as explicit consent).

The VC Diversity Law also requires firms to provide clear written notice to each founding team member explaining what sensitive information is being collected and how it will be used, and to offer a “decline to state” option, elements that align with transparency and fairness expectations under both U.S. state privacy laws (including the CCPA’s notice at collection requirements) and the GDPR. Further, U.S. state privacy laws, including the recently finalized CCPA regulations, and the GDPR’s data protection impact assessment framework reflect a growing expectation that organizations assess and document the privacy risks of processing sensitive data, particularly where it relates to protected characteristics and is ultimately made publicly available, even in anonymized or aggregated form. In practice, venture capital firms should anticipate performing and retaining a pragmatic risk assessment that balances the legal obligation to report against potential impacts on individuals and confirms that appropriate safeguards (such as voluntariness, aggregation, and de-identification) and legally mandated record-retention periods are in place.

Takeaways

The VC Diversity Law is intended to increase transparency into the demographic allocation of venture capital funding, and in doing so potentially increase funding for recipients who appear to be underfunded comparatively. Proponents noted that funding to startups led by women, Black, or Latinx founders has never risen more than 5% in any given year. The law is also intended to increase awareness of existing funding, allowing investors to make informed decisions about which venture capital companies, and which advisers, to support.

In practice, however, the VC Diversity Law may be unwieldly and burdensome for advisers—and not only venture capital advisers—to implement. The law is being adopted at a time when private fund advisers are and will continue to be grappling with expanded reporting and other requirements under the amended Form PF and other expected rules. Key compliance issues for covered entities include:

  • The VC Diversity Law applies to covered venture capital funds advised by all categories of investment advisers, many of whom who have no place of business in California and/or do not have reporting or other obligations under the Advisers Act. It also applies to investment entities with no “adviser” at all, such as family offices investment vehicles, internally managed vehicles, and charitable investment vehicles. These advisers and entities may not have the compliance infrastructure in place to implement such far reaching data collection and reporting requirements of the VC Diversity Law—and may not even realize it captures them.
  • Reports must be submitted by April 1 of each year, with financial penalties accruing for delinquent reports. Practically speaking, this tight timeframe means that advisers should consider completing the survey process on a rolling basis as investments in portfolio companies are made, instead of completing the survey process and generating reports at the end of the calendar year. These reports also must be submitted shortly after a Form ADV filing (March 31) and in advance of a Form PF filing (April 30), as well as a fund’s receipt of its annual financial statements. This means that reported information may differ across reports and raises questions about updating requirements (which were not addressed in the law).
  • Gathering, storage, and management of survey responses regarding sensitive demographic data implicate significant compliance requirements under applicable state, federal or international privacy laws. As such, compliance with the VC Diversity Law will require firms to collect and report highly sensitive demographic data, triggering enhanced privacy law obligations around data minimization, enhanced transparency and, in some cases, consent. Advisers who manage funds subject to the VC Diversity Law should: (i) review both their privacy policies and their data security policies before collecting founder information to ensure sufficient disclosures, (ii) ensure surveys are strictly limited to required data points, include clear written notices at collection and “decline to state” options, and obtain consent if and where required, (iii) document a risk assessment for sensitive data processing, and (iv) rely on the legal-obligation exception under applicable privacy laws to support the required collection, use and disclosure of this information. In addition, as the law does not specify the procedure to be followed for anonymization (only that information will be “anonymized to the extent possible”), we expect this to be an area of focus for compliance departments, particularly for advisers with multi-jurisdictional businesses.
  • Beyond the obvious risk of review and potential enforcement by California regulators, SEC-registered and other federally regulated advisers should expect the SEC Staff to review these reports in examinations and investigations. 
  • For covered entities whose reports appear to indicate sex or race-conscious investing, there may be scrutiny from federal authorities, given the current administration’s approach to diversity, equity, and inclusion programs and policies.
  • Compliance costs related to establishing adequate data management and reporting systems, as well as producing reports on an ongoing basis, could be significant. SEC-registered advisers should consider whether these are compliance costs that can be passed on to investors in the affected venture capital companies. With respect to private funds, we anticipate that advisers may be able to treat compliance costs related to preparation of the required reports as fund compliance costs that may be charged to the fund.
  • The Legislative Counsel’s Digest for the VC Diversity Law notes that “Existing law generally prohibits discrimination in the provision of privileges and services on the basis of sex, race, color, religion, ancestry, national origin, disability, medical condition, genetic information, marital status, sexual orientation, citizenship, primary language, and immigration status. Existing law provides a cause of action against any person who denies, aids or incites a denial, or makes any discrimination or distinction on the bases listed.” This suggests that alleged disparities in the availability of venture capital funding may give rise to lawsuits alleging discrimination under California law. These lawsuits may come from founders from historically underrepresented demographic groups or from founders from majority groups if there appears to be sex or race-conscious funding.
  • To mitigate this risk, venture capital companies should implement practices that demonstrate demographic data plays no role in investment decisions and is collected solely for compliance purposes. Specifically, venture capital companies should ensure that their requests for demographic data from portfolio companies (1) occur only after making the investment decision, and (2) are clearly voluntary. Companies should make it clear in the required disclosures that they make investment decisions solely on the basis of merit. More information on the current enforcement environment regarding DEI practices and steps to mitigate the accompanying litigation risk can be found here.

In addition, the law provides for no grandfathering, so advisers may face a considerable compliance challenge to gather necessary reporting data for legacy funds by the expected effective date. 

In seeking to comply with the requirements of the VC Diversity Law and to mitigate the potential risks associated with compliance, advisers should:

  • Be consistent with the classification they have given an investment vehicle for purposes of reporting on Form ADV, when applying the venture capital company designation.
  • Consider completing the survey process on a rolling basis, with surveys provided to founding team members after investments in portfolio companies are made, instead of completing the survey process and generating reports at the end of the calendar year.
  • Limit surveys to the required data points, include clear written notices at collection and “decline to state” options, and obtain consents if and where required.
  • Review both privacy policies and data security policies before collecting founder information to ensure sufficient disclosures. 
  • Document a risk assessment for sensitive data processing, and ensure appropriate safeguards and legally mandated record-retention periods are in place.
  • Focus compliance department attention on anonymization procedures, particularly for advisers with multi-jurisdictional businesses, as the law does not specify the procedure to be followed for anonymization.
  • Implement practices that demonstrate demographic data plays no role in investment decisions and is collected solely for compliance purposes. To do so, VCs should design their systems for requesting demographic data from portfolio companies such that surveys (1) occur only after making the investment decision, and (2) are clearly voluntary.
  • Make clear in the required disclosures that investment decisions are made solely on the basis of merit.
  • Be aware that SEC-registered and other federally regulated advisers should expect the SEC Staff to review these reports in examinations and investigations. For covered entities whose reports appear to indicate sex or race-conscious investing, there may be scrutiny from federal authorities.

Summary of “Covered Entity” tests

Covered Entities Under California’s Diversity Reporting Law

1. Is the Fund or Other Entity a “Venture Capital Company?”

A Venture Capital Company is ANY of (a), (b) or (c):

a)    California Definition

  • At least 50% of its assets (other than short-term investments pending commitment or distribution), valued at cost, are “venture capital investments” or “derivative investments”

“Venture capital investments:” acquisition of securities in operating/portfolio company as to which the adviser, an entity advised by the adviser, or an affiliated person of either has or obtains “management rights”

“Derivative investments:” acquisition of securities in the ordinary course of business in exchange for existing venture capital investment either:

  • Upon exercise or conversion of the existing venture capital investment, or
    • In connection with public offering of securities or merger/reorganization of the relevant operating/portfolio company

“Management rights:” contractual or ownership right to substantially participate in, substantially influence the conduct of, or provide (or offer to provide) significant guidance and counsel concerning the management, operations, or business objective of the relevant operating/portfolio company

b)     Advisers Act Venture Capital Fund Definition

  • A private fund (i.e., 3(c)(1) or 3(c)(7)) that:
    • Represents to investors that it pursues a venture capital strategy;
    • Holds no more than 20% of aggregate capital contributions and uncalled committed capital, valued at cost or FMV, in assets that are not “qualifying investments”, tested at acquisition of each non-qualifying investment;
    • Does not borrow, issue debt obligations, provide guarantees, or otherwise incur leverage in excess of 15% of aggregate capital contributions and uncalled committed capital;
    • Issues securities that do not provide a holder with the right, except in extraordinary circumstances, to withdraw, redeem, or require repurchase of the securities; and
    • Is not registered under the Investment Company Act.

“Qualifying investments:” any of the following:

  • (i) Any equity security issued by a “qualifying portfolio company” acquired directly by the private fund from the company;
  • (ii) Any equity secured issued by a “qualifying portfolio company” in exchange for an equity security under clause (i); or
  • (iii) Any equity security issued by a majority-owned subsidiary (or predecessor) of a “qualifying portfolio company and acquired directly by the private fund in exchange for an equity security under clause (i) or (ii)

“Qualifying portfolio company:”

  • At the time of private fund’s investment, is not a U.S. reporting company or foreign traded and is not controlled by or under common control with another company that is;
  • Does not borrow or issue debt obligations in connection with the private fund’s investment and distribute to the private fund the proceeds in exchange for the investment; and
  • Is not an investment company (whether a RIC, BDC, private fund, asset backed securities issuer or otherwise) or commodity pool

c)     Department of Labor Definition (Generally tracks California Definition)

  • At least 50% of its assets (other than short-term investments pending commitment or distribution), valued at cost, are “venture capital investments” or “derivative investments”
  • It actually exercised management rights (defined below) during the relevant 12 month period

“Venture capital investments:” investments in operating/portfolio company, other than a venture capital company described in this clause (c), as to which the investor has or obtains contractual rights directly between the investor and the operating/portfolio company to substantially participate in, or substantially influence the conduct or management of the operating/portfolio company (“management rights”)

“Derivative investments:”

  • Venture capital investments as to which investor’s management rights have ceased in connection with a public offering of the operating/portfolio company’s securities; or
  • Investment acquired in the ordinary course of its business in exchange for existing venture capital investment in connection with a public offering of securities or merger/reorganization of the relevant operating/portfolio company, provided the merger/reorganization is made for independent business reasons unrelated to extinguishing management rights

2. If yes to (1), is the Venture Capital Company a “Covered Entity”

A Covered Entity must meet BOTH of the following tests:

a)     Investment Test:  Must primarily engage in business of investing in or providing financing to startup, early-stage or emerging growth companies

b)     Presence Test: Must either

  • Be headquartered in California;
  • Have a significant presence or operational office in California;
  • Make venture capital investments (as defined in California Definition above) in businesses located in or with significant operations in California; or
  • Solicit or receive investments from a person or entity resident in California (solicitation need not occur in California)

3. If yes to (1) and (2), how does the Covered Entity comply?

a)     Register with DFPI:  Beginning March 1, 2026, a covered entity must provide to the California Department of Financial Protection and Innovation, the following information:

  1. Name of the covered entity;
  2. Name, title, and email address of a designated point of contact; and
  3. Designated email address, telephone number, physical address, and internet website of the covered entity.

If an entity fails to update this information by April 1 of any year, the DFPI will notify the entity that it has 60 calendar days from the date of notification to submit the information.

b)     Submit an annual report:  By April 1, 2026, and annually thereafter, the company must report:

  • At an aggregated level, information on the founding teams of all business in which the covered entity made a venture capital investment in the prior calendar year, including information on founding team member gender identity, race, ethnicity, disability status, LGBTQ+ identification, veteran or disabled veteran status, and residency in California;
  • The number of venture capital investments to businesses primarily founded by diverse founding team members, as a percentage of the total number of investments made, in the aggregate and broken down by diversity category;
  • The total amount of venture capital investments to businesses primarily founded by diverse founding team members, as a percentage of venture capital investments made, in the aggregate and broken down by diversity category;The total amount of money in venture capital investments made in each business; and
  • The principal place of business of each company in which a venture capital investment was made.

This information should reflect the covered entity’s venture capital investments made during the prior calendar year.

c)     Collect information via an annual survey:  In collecting the information for the annual report, the covered entity shall:

  • Obtain the information by providing each founding team member of each business that has received a venture capital investment with a standardized form survey provided by the DFPI;
  • Only provide the survey after the covered entity has executed an investment agreement with the business and made the first transfer of funds;
  • Provide a written disclosure prior to or concurrently with the survey that states that disclosure is voluntary, no adverse action will be taken based on declining to participate, and the aggregate data will be reported to the DFPI;
  • Not in any way encourage, incentivize, or attempt to influence the decision of a founding team member to participate in the survey;

Collect and report the survey response data in a manner that does not associate the survey response data with an individual founding team member.

See the full alert memorandum.