On June 29, 2024, Governor Newsom signed into law amendments to a recently adopted California law intended to provide transparency with respect to founder diversity in "venture capital investments" made by "venture capital companies" meeting certain criteria (such law, the "VC Diversity Reporting Law"). These amendments, among other things, (i) with respect to funds, reduce the scope of the law to funds that are more traditional venture capital funds and (ii) extend the first date for reporting diversity metrics to the State of California from March 1, 2025 to April 1, 2026. The amendments generally retained the substance of the law's original reporting requirements, and in-scope funds still must wait for administrative action in the form of a designated survey before they can gather required information under the law. Notably, violations of the law could result in an order requiring the payment of monetary penalties.
Covered Entities under the Law
The VC Diversity Reporting Law applies to "venture capital companies" ("VCCs"), which under the law means one or more of (i) an entity that has, on at least one occasion during the annual period commencing with the date of its initial capitalization, and on at least one occasion during each annual period thereafter, at least 50% of its assets comprising "venture capital investments,"1 (ii) a "venture capital fund" as defined under the Investment Advisers Act of 1940 or (iii) a "venture capital operating company" as defined under the Employee Retirement Income Security Act of 1974.2
VCCs meeting two criteria – one focused on the VCC's business and the other on a California nexus – are rendered "covered entities" subject to the VC Diversity Reporting Law. Under the original law, the business criterion was triggered if the VCC met one of two prongs: (i) primarily engaging in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies or (ii) managing assets on behalf of third-party investors. The second prong implicated all VCCs managing assets on behalf of third-party investors, irrespective of whether those VCCs were investors in traditional venture capital companies—the type of investors on which the law was intended to shed light. The amended law, however, has removed this overly broad second prong, which means that a VCC will only be a "covered entity" and subject to the law if the VCC "primarily" engages in the business of investing in, or providing financing to, startup, early-stage, or emerging growth companies, and has a California nexus. "Startup," "early-stage" and "emerging growth" are not defined terms under the law.
The California nexus prong is broad and was untouched by the July amendments. A VCC meeting any of the following criteria will trigger this prong: (A) the VCC is headquartered in California; (B) the VCC has a significant presence or operational office in California; (C) the VCC makes venture capital investments in businesses that are located in, or have significant operations in, California; or (D) the VCC solicits or receives investments from a person who is a resident of California. Under the last prong, VCCs located in other states could be in scope if they solicit one California resident, even if the solicitation occurs outside of California.
Note that "covered entities" are at the fund level, not adviser level, so a manager will need to analyze which funds it advises are covered entities under the law.
Reporting Dates
In addition to narrowing the scope of the entities required to comply with the law, the amendments revise some reporting requirements under the law, including, importantly, giving covered entities an additional year (until April 1, 2026) to report to the State of California the specified information discussed further below. Accordingly, covered entities must attempt to collect the required information with respect to in-scope companies in which they make investments from January 1, 2025. Adding a new requirement, commencing March 1, 2026, the amended law also requires covered entities to report and maintain as current their name and contact information to the California Department of Financial Protection and Innovation (the "DFPI").3
Reporting Requirements
The VC Diversity Reporting Law requires a covered entity to report, at an aggregated level, for each member of the founding team of all businesses in which the covered entity made a venture capital investment, such person's (i) gender identity; (ii) race; (iii) ethnicity and (iv) disability status. Covered entities must also report whether any member of the founding team (w) identifies as LGBTQ+, (x) is a veteran or a disabled veteran, (y) is a resident of California or (z) declined to provide any of the preceding information.
The law also requires disclosure of the total number and dollar amount (each, as a percentage of total venture capital investments made) of venture capital investments to businesses primarily founded by diverse founding team members, aggregated and broken down by each of the above categories, during the prior calendar year. "Primarily founded by diverse founding team members" means more than half of the founding team members responded to the annual survey, and at least half of the founding team members self-identify as a woman, nonbinary, Black, African American, Hispanic, Latino-Latina, Asian, Pacific Islander, Native American, Native Hawaiian, Alaskan Native, disabled, veteran or disabled veteran, lesbian, gay, bisexual, transgender, or queer. A "founding team member" covers anyone who (i) owned initial ownership interests in the business, contributed (conceptually/developmentally) to the business before such initial shares were issued and was not a passive investor in the business, or (ii) in a change from the original law, is the chief executive officer or president of the business.
Finally, the law requires the covered entity to disclose the total amount of money in venture capital investments the covered entity invested in each business during the prior calendar year and the principal place of business of each company in which the covered entity made a venture capital investment during the prior calendar year. Notably, there is not a requirement to name each "business" in which it made an investment, and covered entities might argue that naming a particular business generically (e.g., "Company A") should be adequate so long as the business-level information is disclosed. However, it is not clear the DFPI will agree with this position, and even if it does, the provision of this information, together with the required disclosure of the company's principal place of business may, if such information is made public, allow third parties to identify the business in question, an outcome that many firms may find troubling.
A covered entity may satisfy the requirements of the law by providing a report prepared by a "business that controls" each covered entity at any time during the prior calendar year if the report contains all of the required information. While there is not a clear definition of "controlling" a covered entity, it should be reasonable for a manager to file a report on behalf of all funds it manages that are in scope.
Gathering Information
Covered entities must use a standardized survey form provided by the DFPI (which is not yet available) to collect information from each of the founding team members, and the surveys must include a "decline to state" option for each question on the survey. The survey may be provided to a founding team member only after the covered entity has executed an investment agreement with the business and made the first transfer of funds. The covered entity will also need to provide a written disclosure to each founding team member either prior to, or concurrently with, the survey that states that (i) the founding team member's decision to disclose their demographic information is voluntary, (ii) no adverse action will be taken against the founding team member if they decline to participate in the survey and (iii) the aggregated data collected for each demographic category will be reported to the DFPI.
Survey results must be collected and reported in a manner that disassociates the responses from individual founding team members. Also, back-up data for reports must be preserved for at least five years, instead of four years in the original version of the law, after the report is delivered. When providing the collected information to the DFPI, the covered entities should anonymize, to the extent possible, the information collected from founding team members.
Public Disclosure of Information and Use of Information
The DFPI will make the reports received from the covered entities readily accessible, easily searchable and easily downloadable on the DFPI's website. The DFPI may publish aggregated data from the survey results submitted to it. While the disclosure of information and the benefits that flow from shining the light on VC funding practices is the intended use of the information, the DFPI may also use the information in a civil action under any law.
Enforcement and Fees
When submitting a report to the DFPI, covered entities must pay to the DFPI a fee of at least $175 per report, adjusted as necessary to meet the reasonable costs of administering the law. If a covered entity fails to file a report, the DFPI shall notify the covered entity that it has 60 calendar days from the date of notification to submit the report without penalty. If a covered entity has not submitted a report within that timeframe, the DFPI may pursue all remedies under the law including, but not limited to, (i) seeking an order requiring the covered entity to desist and refrain from the violation(s), (ii) seeking an order requiring costs, representing reasonable attorney's fees and investigative expenses, and (iii) imposing a monetary penalty for each day during which the violation or failure to pay continues. The law sets forth the following monetary penalties: (a) except as enumerated in (b) and (c), a penalty not to exceed $5,000 for each day during which the violation or failure to pay continues; (b) for reckless violations, a penalty that is sufficient to deter the covered entity from failing to comply with the law but is greater than the penalty set forth in (a); and (c) for knowing violations, a penalty that is sufficient to deter the covered entity from failing to comply with the law but is greater than the penalty set forth in (b). The Commissioner may take into consideration various factors in determining the amount of the penalty, including the amount of assets under management by the covered entity.
The amended VC Diversity Reporting Law also gives the Commissioner of Financial Protection and Innovation (the "Commissioner") investigative powers to include those as set forth in the California Government Code and allow the Commissioner to require a covered entity to (i) produce documentary material for inspection and copying or reproduce in the form or medium requested or (ii) file written reports or answers to questions in order to determine a covered entity's compliance with the law. The Commissioner may also make public or private investigations and publish information concerning any violations of the law. The Commissioner may make, amend and rescind any rules, forms, and orders as needed to carry out the provisions of the VC Diversity Reporting Law.
Privacy Considerations
As discussed in our prior alerts, covered entities should consider how the VC Diversity Reporting Law implicates "comprehensive" privacy laws like the California Consumer Privacy Act (CCPA) in California and similar laws in Colorado, Connecticut, and Virginia. These laws contain restrictions around the use of so-called "sensitive" personal information, which includes race and ethnicity data relating to an identifiable individual. Covered entities that are impacted by the comprehensive state privacy laws are required to make disclosures about their collection and use of "sensitive" personal information and in some cases obtain consent prior to its collection and use. However, the VC Diversity Reporting Law already requires covered entities to provide written notice about their collection and use of "sensitive" personal information and must include a "decline to state" option. In addition, state privacy laws contain exemptions for cases where the obligations would restrict the covered entity's ability to comply with other federal and state laws. Accordingly, covered entities can collect and aggregate the required information regardless of whether consent is obtained under the state privacy laws, but covered entities should consider obtaining consent from the founding team members (in addition to including the required notice provisions) in order to mitigate the risk of possible common law state privacy claims if the survey is completed on behalf of the founding team member (but not by the founding team member themself).
Key Takeaways
We anticipate these amendments to the VC Diversity Reporting Law to be welcome news to many managers because they reduce the number of funds that are within reach of the law and extend the first reporting date for in-scope investments. However, this law remains an additional compliance burden for those managers that have funds that are "covered entities" and requires disclosure of some sensitive information, which some managers may find troubling.
While there is now more lead time to prepare for compliance with this law, a few steps managers can take now to prepare for the first report include (i) identifying which of its funds, if any, would be covered entities under the law, (ii) considering the investment pipeline of covered entities in 2025 to determine which are "venture capital investments" under the law; and (iii) assessing internal compliance functions to gather and report the required information with respect to venture capital investments made in 2025 once the prescribed survey is made available by the DFPI.
Footnotes
1. A "venture capital investment" for purposes of the VC Diversity Reporting Law means an acquisition of securities in an operating company in which the investment adviser or its affiliates obtain "management rights." "Management rights" means the right, obtained contractually or through ownership of securities, either through one person alone or in conjunction with one or more persons acting together or through an affiliated person, to substantially participate in, to substantially influence the conduct of, or to provide (or to offer to provide) significant guidance and counsel concerning, the management, operations or business objectives of the operating company in which the venture capital investment is made.
2. A "VCC" is not, by its terms, limited to pooled investment vehicles or funds; therefore, if an entity meets the criteria set forth herein, then it is within the scope of the law, even if it is not a traditional venture capital fund.
3. Under the revised law, the DFPI replaces the California Civil Rights Department as the department charged with overseeing the VC Diversity Reporting Law.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.