The Biggest Compliance Mistakes Nonprofits Make

Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

And, uh, we are really excited to get into today's topic.

Yeah, today we are doing a deep dive that I think really hits home for anyone running a growing organization right now. We're looking at a document titled "The Biggest Compliance Mistakes Nonprofits Make." It is a great read. It really is. And I have to be honest with you, when I first picked this up, I was kind of ready for a true crime drama.

Oh, like embezzlement or fraud?

Exactly. I expected a list of scandals, you know, people skimming off the top or organizations actively trying to dodge the law.

Because that is usually where our minds go when we hear the word compliance, isn't it? We just assume someone is being naughty.

Right. But here is where it gets really interesting right off the bat, and frankly, a little confusing for the Listener, the source material makes this very bold claim that the organizations making these mistakes aren't bad actors at all.

No, not at all.

They aren't negligent. In fact, these compliance failures are usually a direct result of their success. So, um, help me understand that paradox. How does doing a really good job land you in hot water?

It is totally counterintuitive. Yeah. I mean, we're conditioned to think of state registration and compliance as the police force. Yeah. The thing that catches you when you've done something wrong.

Like a punishment. Exactly. Yeah.

But if we look at the patterns in this research, compliance issues in the nonprofit sector are almost always just growing pains. They happen because the fundraising arm of the organization has sprinted ahead.

Doing exactly what it's supposed to do, right?

Right. Raising money, expanding the mission. Meanwhile, the back office infrastructure is still jogging along behind trying to catch up.

So essentially you can be penalized for being too good at your job. If I'm a development director and I completely crush my goals, I might actually be breaking the law.

In a way, yes. Because if you're good at raising money, you're creating a regulatory footprint.

Mm-hmm.

You are expanding the map of where you owe explanations to the government. And if you don't build the administrative road while you're driving the fundraising car, you're eventually gonna crash.

That is a terrifying image. But let's dig into why this actually happens. The source talks about something called the informality trap. Is that just a polite way of saying these organizations are being sloppy?

No, I don't think it's about sloppiness at all. It's really about the DNA of a startup nonprofit. Think about how most of these organizations begin.

Super small, right?

You're local, you're scraping by. Everyone is wearing 5 different hats. The executive director is probably also the janitor and the social media manager and the grant writer.

Yeah, they're just trying to keep the lights on.

Exactly. In that environment, compliance is usually just filing your initial incorporation papers and maybe your annual IRS Form 990. It feels very personal, low stakes, and hyperlocal.

You aren't thinking about the attorney general of a state on the other side of the country. You're just thinking about the donor across the street.

Exactly. But here is the friction point. That informal process just doesn't scale. As you get successful, You stop just asking your neighbors for money and you start asking the internet or a national network.

But the internal mindset stays local.

Yes, the mindset stays in that informal mode. The source notes that leaders often operate on these really dangerous assumptions.

They assume registration only applies to the massive players like the Red Cross, or they assume that just because they're physically sitting in an office in one state, their online fundraising doesn't somehow change their jurisdiction. Right.

Or my personal favorite, the classic assumption of surely someone else is handling this.

Oh yeah, the ownership void.

It's a huge issue. It's not a lack of effort and nobody is trying to be lazy. It is simply a lack of clarity regarding ownership and timing. They don't know who is supposed to own it. Is it finance or development or legal?

And they don't know when the trigger happens.

Precisely.

Well, that segues perfectly into the first specific mistake listed in our stack here, which I think is probably the most relatable one for you listening. I call it the ostrich strategy, but the text calls it the reactive trap.

Waiting for a problem to make noise before you fix it.

Exactly. Burying your head in the sand.

This is mistake number 1, and it is so dangerous because silence does not equal safety. Many organizations operate under the belief that if they haven't heard anything from the state, they are perfectly fine.

But usually by the time you hear something, you are already in the danger zone, right?

Oh, absolutely.

Okay, so paint the picture for us. What does hearing something actually look like? Are we talking about police knocking on the office door? What is the noise?

Hopefully not the police at the door, but the wake-up calls highlighted in the source are still pretty painful. The first one is the inquiry letter. This is a letter from a state agency, say Florida or California, basically saying, hey, we see you're soliciting in our state. Maybe we saw you on social media, or maybe a donor tipped us off that we don't have a record of you. Please explain yourself within 30 days.

Oh boy. And that just sets off a massive scramble.

A huge scramble. Yeah. Because now you aren't just filing a routine form, you are answering a legal inquiry. You're on the defensive.

That's stressful.

It is. But the second wake-up call might be even more painful financially. Imagine you have applied for a really significant grant. You've done the work, you've won the proposal, the foundation is literally ready to cut the check.

Okay.

And then their compliance officer asks for your proof of charitable registration in their state.

Oh wow. So the money is just sitting there frozen.

Exactly, frozen. And unlike Amazon Prime, registration isn't instant. It can take weeks or even months depending on the state's backlog. So you are now holding up your own funding because of a paperwork oversight.

That is a very difficult conversation to have with your board of directors.

Extremely difficult.

Hey guys, we won the million dollars, but we can't touch it because I forgot to file a $50 form. That feels like a career-limiting conversation.

It really is. And the third wake-up call is the auditor. If you are large enough to require an independent audit, a good auditor is going to look at your revenue streams, see donations from 20 different states, and ask, where are your registrations for these? And if you don't have them, then it becomes a red flag, a deficiency in your management letter or audit report.

So the key insight here is that if you are waiting for one of these three things to happen, you have already failed the strategy test. You're being reactive, right?

Compliance has to be evaluated alongside growth. If you are planning a big fundraising push, you need to be planning the compliance that goes with it. You just can't treat it as an afterthought.

That leads us right into mistake number 2, which feels to me like the biggest modern hurdle, the "we're just local" fallacy. I feel like the internet has completely blurred the lines here.

It really has.

I mean, be honest with me, if I just put a simple donate button on my website, Am I suddenly soliciting in all 50 states? Because that seems incredibly unfair to a small shop.

It is one of the most debated areas in the whole sector. It's where the physical reality of the nonprofit clashes with the virtual reality of fundraising.

Yeah.

A lot of leaders think our staff is here, our programs are here, so we are a local charity.

Right.

But the moment you put a donate button on your website, you are potentially accessible to everyone everywhere.

But practically speaking, does just having that button immediately trigger the requirement to register in 41 different states?

It is nuanced. There are guidelines like the Charleston Principles that try to define this distinguishing between passive availability and active solicitation. But the source material makes a really key point about quiet expansion.

Quiet expansion. What does that look like?

You might not buy ads in California, but what happens if your email newsletter gets forwarded by a supporter?

Oh, I see.

Or a social media campaign goes viral. Or maybe you develop a partnership with a company that has a national presence.

Right. So you didn't actively target those out-of-state donors, but they found you anyway.

And once they find you and start giving, the regulatory expectation shifts. The source points out that online fundraising changes the scope of compliance without anyone ever officially launching a national campaign.

It's passive expansion.

Exactly. You wake up one day and realize 30% of your donors are from out of state. If you're still operating like a local charity, you're completely exposed.

It's almost like accidental success is the most dangerous kind of success.

Yes.

Okay, let's talk about the little guys for a second. Mistake number 3 is the exemption misunderstanding. I assume there are rules that say if you make less than X dollars, leave us alone, right?

Yes and no. And this is where it gets super trippy. The source calls this a major misunderstanding. Yes. Many states do have exemptions for smaller organizations, often based on total revenue or how much you specifically raise in that state.

Okay, so there is a threshold.

There is. For example, maybe you only raise $5,000 in Tennessee, so you fall under their threshold. But, and this is the critical detail, exemptions are rarely automatic.

What, you mean you can't just ghost them?

You absolutely cannot just ghost the state. In many jurisdictions, you have to file a formal request just to claim the exemption.

Are you kidding me?

No, you have to submit documentation proving that you are small enough to be left alone.

That is painfully ironic. You have to do paperwork to prove to the government that you don't have to do paperwork.

Precisely. And that's the trap right there. A small nonprofit ignores the letter or the requirement because they think, oh, we only raised $5,000, we're exempt.

But they never told the state that.

Exactly. Because they didn't file the form claiming that exemption, the state views them as noncompliant. The state doesn't know you're small. They just know you're silent.

Wow. Being small doesn't mean you can ignore the agencies entirely.

Not at all.

That is a huge lightbulb moment. I can see so many organizations falling into that trap, thinking the rules don't apply. But the rule is you have to prove the rules don't apply.

You nailed it.

Now, mistake number 4 connects right back to what we were saying earlier about accidental growth. The document calls it flying blind or not tracking donor geography.

This is fundamentally a data problem. Nonprofits are usually very good at tracking total dollars. We raised $1 million this year.

Great.

Everyone claps.

We're top the champagne.

But if you ask them which states did that money actually come from, many of them have to go dig deep into the raw data to find out.

They're so focused on the how much that they ignore the where.

And without that location awareness, as the source calls it, you can't see the multistate obligations forming. You're flying blind.

You don't see the storm coming, right?

If you have a cluster of donors forming in Florida or New York, those repeated donations create a pattern and regulators look for patterns.

So if you aren't running a regular report that sorts your donors by state, you're basically just waiting to be surprised.

Exactly. And surprise is the enemy of compliance. Simple reporting visibility prevents this. It's not about complex analytics. It is just knowing where your support is coming from so you can match your registration footprint to your donor footprint.

Makes total sense. Yeah. Okay, let's move to mistake number 5. This one is for the people who actually did the right thing. They did the work, they filed the forms, they got registered, and then they stopped. The one and done mindset.

Ah, yes. The set it and forget it error. You feel that huge relief of getting the initial registration approved. You have the certificate, you frame it on the wall.

Check that box.

But compliance isn't a one-time task. It is an ongoing operational responsibility. It's a cycle.

Because of renewals.

Renewals. Yes. Yeah. Most states require annual filings.

Yeah.

But it's more than just filling out the same basic form again every year. You have to submit updated financial reporting.

Right.

And here is where the growth trap comes back with a vengeance. As your fundraising totals grow, the level of financial reporting required by the states often increases.

What does that actually look like? Gimme an example of these levels because I think a lot of people just assume a tax return is a tax return.

It's definitely tiered. When you were small, maybe a simple internal financial statement, just your basic profit and loss was enough for the state.

Okay.

As you grow, the state might require a compilation, which is done by an accountant, but is still fairly basic. Then you hit the next tier and they need a review.

Getting more expensive.

Very. And then once you hit a certain threshold, say $500,000 or $750,000 in specific states like Pennsylvania or New York, they require a full independent audit.

Oh, I see. So you might try to renew it the exact same simple stuff you sent last year, but because you had a great fundraising year, the state rejects it and demands an audit.

Correct. And audits are expensive and they're incredibly time-consuming. If you aren't anticipating that threshold, you can get stuck in this terrible compliance limbo because you can't renew until the audit is done. Right. And the audit takes 3 months. Meanwhile, your registration lapses and you're right back to receiving those nasty inquiry letters we talked about earlier.

That sounds like a total nightmare. And it really seems like it stems from not having someone whose specific job it is to watch for these tripwires.

Which brings us perfectly to mistakes. 6 and 7.

Right. The source material sort of groups these together as organizational failures, ownership voids, and scaling complexity.

The ownership void is fascinating to me because it's a structural flaw built into so many nonprofits. We touched on this earlier, the tug of war.

Yeah.

You have the development team who are entirely focused on the future, bringing in new money.

Right.

Then you have the finance team who are focused on the past, reporting on what already happened. Compliance sits very awkwardly right in the middle.

It's the orphan department.

It really is. Development thinks, well, this involves tax forms, so it's definitely a finance problem. Finance thinks, well, this is triggered by active fundraising, so development should handle it. And leadership just assumes surely someone has it covered. And when everyone assumes someone else is doing it, nobody is doing it.

Resulting in missed deadlines and lapsed registrations. The source emphasizes that successful organizations assign explicit ownership. It really doesn't matter who it is, but it has to be someone.

Absolutely. But even if you have a dedicated owner, there's still the sheer volume of the work. Mistake number 7 is underestimating the complexity multiplier.

The document mentions that managing 40 states is exponentially harder than managing 2. Why is that? Is it really just more paper?

It's not just the volume of paper. It's the total lack of standardization. It's the coordination cost. If every single state had the exact same deadline and the exact same form, it would be easy.

But they don't.

Not at all. It is a patchwork of 41 different sets of rules.

Give us some examples of the chaos. How different can they actually be?

Well, take the deadlines, for example. Yeah. Some states want renewals on the anniversary of your initial registration. So if you registered in March, you renew every March.

Okay. That makes sense.

But others want it 4.5 months after your fiscal year ends, which puts it in May. Others want it in November.

So you can't just have one big compliance day once a year and knock it all out.

No, it's a year-round calendar.

Yeah.

And it gets even more granular than that. Some states require signatures from two different corporate officers. Some need original documents mailed physically with a wet signature, while others only accept digital uploads.

Wow.

Some fees change based on your revenue. Others are just flat fees.

So you're managing 40 different timelines simultaneously. It sounds It's literally like herding cats.

It is. And remember, you are managing correspondence from 40 different regulators. If you treat this as a side-of-the-desk project, you will drown.

Yeah, you can't wing it.

The complexity multiplier means that as you scale, you have to have a system. You cannot just wing it with an Excel spreadsheet and good intentions.

I have to admit, this all sounds incredibly overwhelming. I'm feeling a little stressed just listening to it. So let's pivot to the solution before we all hyperventilate. The source material offers a proactive framework. How do we stop the bleeding here?

The good news is that you don't need to be thinking about this 24/7. You don't need to go hire a full-time compliance officer tomorrow if you're a small shop. You just need a diagnostic routine.

Okay, a routine.

The source suggests asking a few specific questions periodically. Maybe you do this quarterly or right before you launch a new strategic plan.

What are the questions we should be asking?

First, where are our donors currently located? Run that report we talked about earlier. Look at the actual data. Don't guess. Right.

Get the location awareness.

Second, has our fundraising footprint expanded geographically? Do we launch a new online campaign? Do we get a grant from a foundation in a new state?

Okay, what's next?

Third, are renewal deadlines being tracked centrally? Is there an actual calendar system that alerts us, or are we just relying on sticky notes on someone's monitor?

Sticky notes are definitely not a system.

And finally, Has anyone reviewed the requirements recently? Because state laws do change and thresholds do increase. Mm-hmm.

It's like a health checkup. You don't need to live at the doctor's office, but you absolutely need to go in for a physical once a year.

Exactly. Compliance reviews don't need to be constant, but they must occur as your fundraising evolves. If you link the two together—we're growing here, so we must check our compliance here—you solve 90% of the problems.

So if we zoom out, what does this all mean for you, the listener? We started this deep dive by saying these aren't bad people making these mistakes. Right.

And I really want to reiterate that point. If you are listening to this and realizing, oh no, we might be making mistake number 4 right now, please don't panic. Reframe the issue. Reframe it how? Compliance problems are almost always a symptom of growth. They're a side effect of your success.

That is a much healthier way to look at it. You're not a criminal. You're just successful and temporarily disorganized.

Ideally, we want to be successful and organized. As a nonprofit becomes more successful, regulatory expectations are naturally going to expand. You can't avoid it. No, the goal isn't to avoid regulation. That's impossible if you want to be a national player. The goal is to integrate reassessment into your growth planning. That leads to true operational stability. You want your back office to be just as robust as your mission.

I love that because stability allows you to focus on the mission without constantly looking over your shoulder. Precisely. I want to leave our listeners with a final provocative thought based on what we've unpacked today. We talked earlier about the silence, the lack of inquiry letters from the state, right? If compliance issues are a symptom of growth, then silence from regulators doesn't necessarily mean you're operating in safety. Not at all. It might just mean you haven't checked where your success has taken you yet. You might actually be much bigger than you think you are.

That is a really powerful thought. The map has changed. Yeah.

You just haven't looked at it yet. Exactly. So take a look at the map, run the report, ask the questions. It's always better to know. Always better to know. If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.