The Compliance Risks of Online Fundraising Platforms

Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

It is so great to be here.

So, uh, I want to start this deep dive with a little story. I was sitting in a finance committee meeting the other day, and we're looking at a revenue report.

Always a fun time.

Right. And it was actually a really good report. Donations are up. The end of year campaign is humming along. But then I started looking closely at the zip codes.

Ah, the zip codes.

Yeah. We have donors in Oregon, donors in Florida, this really weird cluster of donations in Minnesota. And my first instinct, you know, as a fundraiser, was just to celebrate.

Of course. That means your message is working.

Exactly. But my second instinct, the one that sort of keeps me up at night, was, wait a minute, we aren't registered in Minnesota.

Yeah, that is the classic— moment of panic for the modern nonprofit leader.

It really is, because we live in this, this era of what I call the easy button. You know, you sign up for a platform, you apply a few settings, and boom, suddenly you have a global storefront, right? The whole tech stack, whether it's crowdfunding, peer-to-peer pages, those little donation widgets, it's all designed to be completely frictionless.

Frictionless for the user.

Yes, right. But I have this nagging feeling that while the tech is frictionless, The law is still full of friction.

You are absolutely right to feel that way. And honestly, that tension is exactly what we need to unpack today because we're dealing with 21st century tools that are operating in a legal framework that is, well, in a lot of ways still stuck in the 20th century.

So the overarching mission for our deep dive today is really tackling that gap.

Yes. The main takeaway you need to keep in mind is that accessibility does not equal immunity.

Okay. See, that phrase actually scares me a little bit. Accessibility does not equal immunity.

It should scare you, Auli'i.

Because logically, you think about it, if a platform— let's just call them Megafund for the sake of argument.

Sure. Megafund.

If Megafund takes my credit card, processes the transaction fee, and sends the tax receipt to the donor, shouldn't they be the ones worrying about the state of Minnesota?

Logically?

Yeah.

Maybe. I mean, it makes sense from a layperson's perspective. But legally, No. And this is exactly where so many organizations get themselves into really hot water.

They assume the technology is handling it, right?

They assume the technology creates this sort of legal shield. They think, I'm just the user here. The platform is the actual entity moving the money.

Yeah.

But today we're going to walk through why that is an incredibly dangerous assumption. We'll look at the specific legal frameworks, like the Charleston Principles that actually govern this stuff, which we will definitely get into. Absolutely. And then we'll talk about practical steps. How to actually keep your board from freaking out when a campaign goes viral in a state where you have exactly zero paperwork filed.

Okay, let's get into the weeds then, because I think a lot of us operate under this, this illusion of safety.

The illusion of safety. I like that term.

Well, it's true, right? When I log into a modern fundraising dashboard, it looks totally compliant. It looks professional. It feels like this perfectly self-contained ecosystem. So why isn't it?

It feels complete because the user experience is beautifully designed to be seamless. But you really have to distinguish between the mechanism and the obligation.

Okay, unpack that. Mm-hmm. Mechanism versus obligation.

Think about it strictly in terms of finance. The platform you're using is a payment processor. They are a conduit. Their entire job is to move funds from point A, the donor, to point B, your bank account.

Right. They're just the pipes.

Exactly. But the state regulators, so the attorneys general offices across the country, they aren't looking at who moved the money. They are looking at who actually asked for the money.

Ah.

The platform manages the transaction. They do not manage the fiduciary and legal obligation to solicit.

So the platform is basically the digital equivalent of the mailman.

That's a great way to put it.

Like, just because the mailman delivered the letter to the donor's house doesn't mean he wrote the fundraising appeal that was inside it.

Exactly. And you wouldn't expect the US Post Office to register as a charity just because they physically delivered your direct mail.

Yeah, of course not. That puts it in perspective. But let me push back on this just a little bit. Go for it. Because online platforms, they do a lot more than just deliver mail. They host the campaign page. They put their own branding and logo on the receipt. To a donor, it often looks like I'm giving my money to the platform for the charity. Doesn't that blur the line of who the solicitor actually is?

It definitely blurs the line for the donor, perhaps. But let me be clear, it does not blur the line for the regulator.

Really?

Not at all. The regulator looks strictly at the beneficiary. You are the one ending up with the cash. You are the organization whose mission is being advertised on that page. Therefore, the state views the nonprofit as the solicitor.

So I can't just throw up my hands and say, hey, talk to Megaphone. They're the ones who took the money.

I mean, you can try, but it's not going to work. The platform is a tool. It's not a shield. And this brings up what I call the agency myth.

Agency myth.

Yeah. I see this all the time with finance directors. They are incredibly savvy about numbers and spreadsheets, but maybe they haven't read the terms of service for their fundraising software in a couple of years.

I'll be totally honest with you. I usually just scroll past the terms of service and hit accept like everybody else on the planet.

We all do it for software updates, but for enterprise fundraising tools, it's risky.

What am I missing in the fine print there?

If you actually open up those contracts, whether it's a popular crowdfunding site or a major CRM donation processor, there is almost always an indemnification clause buried in there.

Oh boy.

It will say something along the lines of, the user represents and warrants that they are in compliance with all applicable laws and regulations in the jurisdictions where they solicit.

Ouch. So they are explicitly putting the legal burden right back on me in the contract I signed.

Explicitly. They're entirely washing their hands of it. They're telling you, we provide the tech, you provide the compliance. So if you get a scary letter from the state of Florida asking why you're soliciting their residents without a license, you cannot point your finger at the platform. You signed a legally binding contract saying you had the compliance covered.

That— That really feels like a trap, especially because, as we were saying earlier, the internet is everywhere.

It is everywhere.

If I launch a campaign today, I'm not actively targeting Florida. I'm just putting it on the web. How do regulators even handle that? Because if the rule is you must register where you are seen, then every single website in the world needs to register in all 41 states that require it. And that just seems impossible.

That would be impossible. The system would collapse. And that is exactly why we have to talk about the Charleston Principles.

Okay, let's break this down because I hear this term thrown around. Is this an actual law? A set of guidelines?

It's a framework. Back in 2001, the National Association of State Charity Officials, which is basically the collective group of state regulators, they realized the internet was fundamentally breaking the old direct mail model of compliance.

Right, because geography didn't matter anymore.

Exactly. They couldn't practically require registration for every single passive website hit. Oh, so they came up with the Charleston Principles to define when online activity actually triggers a registration requirement.

So what's the trigger? How do they define it?

It usually comes down to two main concepts: domicile and substantial ongoing contact. Obviously, if you are based in a state, you're domiciled, you have to register there. That's the easy part.

Sure. I'm based in Ohio. I register in Ohio. Makes sense.

Right. But for all the other states, the principles look for active solicitation. They draw a very distinct line between a passive website, which is just a donate button sitting there waiting for organic traffic, and active solicitation where you are pushing a message out or targeting specific residents.

Okay, let me give you a scenario to test this.

Let's hear it.

If I just have a simple donate button on my homepage and some guy in Texas stumbles across my website, reads my mission, and gives me $50, am I in trouble in Texas?

Under the Charleston principles, generally speaking, no, that is considered a passive receipt. Yeah, you didn't actively target Texas. He found you.

Okay, good.

However, and this is the massive gotcha that catches everyone, what do you do after he donates?

Well, I thank him, obviously. I send him a tax receipt, and, well, I probably put him on our email newsletter list.

And there it is.

Oh no.

The very moment you put him on your email list and send your next quarterly fundraising appeal, you have converted a passive donor into an active solicitation.

You're kidding.

You are now actively emailing a resident of Texas asking them for money. That is no longer passive.

That is terrifying because that's just fundraising best practice. Every consultant tells you steward your donors, retain your donors. You're telling me that good fundraising strategy is essentially a compliance trap.

It creates a regulatory nexus. Yes. If that engagement becomes repeated and ongoing, or if the overall contributions from that specific state become substantial, which is admittedly a vague term, but regulators definitely know it when they see it. You have crossed the line. You are now soliciting in Texas.

Wow. This actually brings me to a scenario that I think scares nonprofit leaders even more than their own email lists.

What's that?

Other people.

Ah, yes.

Because we constantly encourage peer-to-peer fundraising. We literally beg our supporters to start their own campaign pages for their birthdays or whatever.

This is hands down one of the biggest uncontrolled risks in the entire sector right now.

I'm thinking of this war story I heard recently at a conference. It was a small animal rescue. They did this name the puppy contest online.

Those always do well.

Right. It went completely viral on Twitter or X or whatever we're calling it these days. They raised something like $50,000 in a single weekend. It was amazing for them until the finance team realized they had donors from 48 different states.

And I'm willing to bet they weren't registered in 45 of them.

Exactly. And the core issue wasn't just the sheer volume of money. It was that other people were spreading the link. They suddenly had these unofficial ambassadors actively soliciting their own networks in California, New York, Illinois. Does the law actually view those independent ambassadors as us?

Generally, yes. This circles right back to the agency problem we talked about. When you intentionally set up a peer-to-peer campaign structure, you are effectively deputizing your supporters to be fundraisers on your behalf. You are authorizing them to solicit.

But I can't control them. I can't control if my aunt in New Jersey decides to forward the donation link to her entire bridge club.

The regulators don't care about your lack of control. They care about the end result. If your deputies are bringing in significant funds from residents of New Jersey, the state views that as your organization availing itself of the generosity of New Jersey residents. You are the ultimate beneficiary.

So in that puppy contest example, the rescue organization is suddenly liable for the compliance paperwork in all those new states simply because their fans were a little too enthusiastic.

Potentially, yes. If the activity is deemed substantial, it's what I call a success disaster. You successfully raised the money, which is fantastic for the mission, but you inadvertently created a massive administrative footprint literally overnight.

That feels incredibly unfair, especially to smaller organizations. It really feels like a tax on success. Like, congratulations on your campaign going viral. Here is a bill for $10,000 in state registration fees and a mountain of notary requirements.

I hear that exact frustration constantly, and I validate it. It is a heavy burden, but you have to look at it from the regulator's perspective for a second.

Okay. Play devil's advocate.

Their fundamental job is to protect their citizens from fraud. If an organization, even a well-meaning legitimate one like an animal rescue, is pulling significant money out of their state economy, the regulator wants to know who they are, where that money is actually going, and if they are a legitimate operation.

Which naturally brings us to the visibility trap, because the internet doesn't just let you ask for money across borders, it creates a permanent searchable record of everything you said while doing it.

Precisely. Think about the old days. If you sent out a direct mail letter with a typo or maybe a slightly exaggerated claim about your programs, it went in the donor's trash can and was gone forever. Now, your campaign copy, your impact claims, your About Us page, it lives forever online.

How does that specific visibility impact the finance team, though?

It's all about consistency. A savvy regulator in California might look at your Form 990, look at your state registration filing, and then pull up your website. If your website boldly says, "We are operating nationwide to end hunger," but your legal registration says you only solicit in 3 local states, you have just painted a massive target on your own back.

It's a glaring discrepancy.

It's a massive discrepancy. You are publicly claiming a national footprint for marketing purposes while legally claiming a local footprint to avoid fees. That is incredibly low-hanging fruit for a state auditor.

Okay, I'm sufficiently stressed out now.

That happens a lot in this line of work.

I bet. Let's try to pivot to some actual solutions before I resign and go live in a cave somewhere.

Good idea.

If I'm a finance director listening to this deep dive right now, and I know our development team is planning a massive digital push for year-end giving, what do I actually do? Because I can't just walk in there and say, stop fundraising.

No, and you absolutely shouldn't. You don't want to stifle growth. You just need a strategy that matches your operational reality. I usually break it down into 4 practical steps for my clients.

Okay, hit me. I'm taking notes. Step 1.

Step 1 is review donor geography. Stop guessing where your money's coming from. Go into your CRM right now, whether it's Salesforce, Razor's Edge, whatever system you use, and pull a hard report of donations by state for the last 12 to 24 months.

And what exactly am I looking for in that data? Just the $50 outliers?

No, ignore the one-offs for a moment. You are looking for clusters. You are looking for trends. If you pull that report and see that 15% of your total revenue is suddenly coming from New York and you aren't currently registered in New York, that is a 5-alarm fire. That state becomes your immediate priority.

Okay, so triage the big numbers first. That makes sense. What's step 2?

Step 2 is align strategy. This is where the finance director needs to take the development director out for coffee. You need to know exactly where they are planning to aim the cannon next.

Right. If the marketing team is buying Facebook ads specifically targeting the Pacific Northwest, I really need to know that before the credit card processor bill comes in.

Exactly. You cannot let the marketing get ahead of the legal compliance. If the strategic plan is to expand into a new region, the state registration needs to precede the actual solicitation. It takes real time to get approved by these states. You cannot file the paperwork on Monday and launch a multi-state ad campaign on Tuesday.

That is a huge cultural shift for a lot of nonprofits. Marketing usually operates on a move fast and break things mentality.

And in this specific context, if they break things, they are literally breaking the law. Which leads directly to step 3: Periodic reassessment. Compliance isn't a one-and-done checkbox. It's a garden. You have to constantly weed it.

Meaning just because we were totally compliant last year doesn't automatically mean we are compliant this year, right?

Maybe last year you had zero donors in Florida, completely off the radar. But this year a board member moved down there through a house party and now you have 200 active donors. Your operational footprint changed, so your legal filings need to change to match it. This really should be a standard part of the annual audit process, or at least a quarterly internal review.

Got it. And what's the fourth step?

Step 4 is coordination. You have to get the fundraising team and the finance team in the same room on a regular basis. I can't even tell you how often I see a fundraising team buy a flashy new piece of software, some new app for text-to-give or mobile bidding, and the finance team only finds out about it when the weird deposits start hitting the bank account.

And by that point, the multi-state solicitations have already happened.

Exactly. The liability has already been created. And finance is just left holding the bag.

I do want to address the elephant in the room with all of this, though. All of this compliance work, it costs money.

It does.

There are state registration fees. You probably need to hire a specialized firm to help manage the mountain of paperwork. For a mid-sized nonprofit trying to be lean, this looks like pure overhead that doesn't actually help deliver the mission.

It is overhead. I won't sugarcoat that, but I really think we need to reframe how we look at it. Instead of viewing compliance as a punitive tax on success, we should view it as a milestone of legitimacy.

A milestone of legitimacy? In the eyes of the donor, you mean? Yes.

Think about the concept of trust. We live in a heavily digital world where scams are incredibly easy to set up. I could personally build a fake charity website in 10 minutes using AI copy and some stock photos.

Sadly true.

In that environment, a major donor who is actually doing their due diligence— maybe they're checking Charity Navigator or looking at your public filings— they want to see that you are thoroughly vetted. When you are fully and properly registered across the country, you are signaling to that remote donor, who has never met you in person, that you are a real organization, that you play by the rules, and that you are worthy of their digital dollar.

So transparency itself is the currency.

Transparency is the ultimate currency of the internet. If you want to play on the national stage, which is exactly what these online tools allow you to do, You have to follow the national rules. You simply can't be a national player with a local small-town compliance mindset.

That is a really powerful way to look at it. It's growing pains, sure, but it actually means your organization is growing.

Exactly. It's a sign of maturity.

So let's recap the journey we've been on today. The easy button of modern tech platforms is fantastic for driving revenue, but it acts as a dangerous blindfold for compliance. We learned that the payment platform is not the solicitor we are. We dug into the Charleston Principles and saw how an active follow-up, like a simple newsletter, can convert a passive, accidental donor into a real regulatory nexus. And most importantly, we learned that while we can't always control what our enthusiastic supporters do online, we are absolutely responsible for the result.

That perfectly sums it up. Use the modern tools, But know your legal obligations. Don't let the ease of the click distract you from the weight of the law.

And for those finance directors out there who are suddenly sweating about the puppy contest scenario we talked about, start with your donor data today. The numbers will tell you exactly where you need to be.

Absolutely. Data over panic, every single time.

Well said. I want to leave everyone with one final thought to mull over. As we expand our digital footprints, consider how robust compliance doesn't just protect you from fines, It acts as a proactive marketing tool. It proves your integrity to a skeptical digital world before you even make the ask.

A great point to end on. If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.