What Happens If You Fundraise Without Registering?
In this episode of the Nonprofit Compliance Brief, hosts from Ironwood Registrations dissect the hidden dangers of ignoring charitable solicitation registration requirements. They debunk the myth that only mega‑charities need to register, explaining that modern statutes trigger registration the moment a nonprofit intends to solicit, regardless of whether a donation is actually received. The conversation walks listeners through the Charleston Principles—distinguishing passive from targeted activity—and shows how digital tools (email blasts, social‑media ads, algorithmic placement, QR codes, and peer‑to‑peer campaigns) turn seemingly passive outreach into targeted solicitation across state lines. Real‑world enforcement vectors are highlighted, including IRS Form 990 Schedule G disclosures, data‑analytics sweeps, and anonymous tips, which can expose nonprofits to audits, fines, loss of good standing, grant holds, and even board member liability. The hosts identify “accelerants” that instantly raise red flags, such as hiring professional solicitors or consultants, and the rapid expansion of peer‑to‑peer fundraising. They then provide a step‑by‑step risk‑assessment and maintenance checklist for CFOs: map revenue by state, audit ask footprints, verify website disclosures, prioritize registrations in high‑risk or strict‑enforcement states, and establish ongoing renewal processes. Finally, they argue that compliance is not merely a cost but a strategic trust signal that appeals to modern donors, especially Millennials and Gen Z, who demand transparent, verifiable operations. The episode equips nonprofit finance leaders with both the legal framework and practical tools to avoid costly compliance failures while leveraging good standing as a fundraising advantage.
Chapters
Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multistate fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.
Thanks for having me back. I am really looking forward to getting into this one today.
Yeah, me too. Today we are tackling what is probably the ultimate administrative headache the one that sits right at the bottom of every CFO's to-do list.
Oh, yeah. The one we all secretly hope will just sort of resolve itself if we ignore it for a few fiscal quarters.
Exactly. We are talking about charitable solicitation registration, and specifically, we're going to examine the really dangerous wait-and-see approach that so many organizations seem to take.
It is the classic compliance trap. You tell yourself, well, we will deal with the state registrations once we are big enough to actually be on their radar. Yeah, but the problem And what we are really gonna unpack for you today is that the definition of big enough has fundamentally changed. And frankly, the legal definition of fundraising itself has changed way faster than most finance teams even realize.
I think for a long time, the prevailing wisdom in the nonprofit sector, or maybe just the prevailing hope, was that this was only a problem for the mega charities. Mm-hmm. Like if you aren't the Red Cross and you aren't running some massive national telemarketing campaign, why on earth would the Attorney General of Pennsylvania care about your midsize nonprofit?
Right. Why would they care?
But looking at the regulatory landscape we have right now, that feels like an incredibly dangerous assumption to make.
It's a very dangerous assumption, and it is one that usually gets corrected in the most inconvenient way possible.
Like during an audit.
Yes, exactly. Right in the middle of a financial audit or when you're going for a major grant application. The reality is that the legal requirement to register kicks in way earlier than most executive directors are comfortable with. It often triggers before you even think of your own organization as having a national footprint.
So let's strip this all down. The mission of our deep dive today is to get past the basic nonprofit 101 stuff.
We all know we have to register eventually.
Exactly. What we want to understand today are the actual triggers. We want to understand the Charleston Principles. And how they apply to modern algorithms, not just, you know, a basic HTML website from the 1990s, which is when they were written. Yeah. Right. And we need to give you a practical framework for risk assessment because at the end of the day, compliance is just a cost-benefit analysis.
Precisely. And to do that analysis properly, you have to start with the legal bedrock.
You have to look at the definition of solicitation, which is way broader than just successfully getting money, isn't it? I mean, looking at the source material, the statutes in states like New York or California, they actually do not care if the check clears.
No, they absolutely don't. And this is the very first place that finance teams get tripped up. The legal trigger isn't the receipt of a gift. The trigger is the ask itself.
The intent to ask. Yes.
The statutes are written entirely around the intent to solicit. So if you have any mechanism in place to accept funds a donate button on your homepage, a crowdfunding link, even just a QR code on a PDF flyer, you have arguably solicited. It doesn't matter if anyone actually used it.
Okay, but let me play devil's advocate for a second here. If I put a donate button on my website, I'm obviously hoping for donations. We all are, right? But am I really soliciting a resident of, say, North Dakota just because they happen to stumble onto my site and see that button?
That is the million-dollar question right there. If you look at the strict letter of the law in many jurisdictions, the answer could technically be yes.
Wow. Even just passively having the button?
Technically, yes. But obviously that is completely unenforceable at scale. If every single nonprofit with a website had to instantly register in all 41 jurisdictions that require it, the entire sector would just collapse under the weight of the paperwork.
Yeah, the state attorney general offices would grind to a complete halt, too.
Exactly. They couldn't process it all. So for years we have been operating in this sort of gray area. But the issue now is that the ask is becoming so much easier to track because it's digital, because it's digital. It's not just a static website anymore. It is the email blast. It's the social media share. Think about it this way. When you send out your end-of-year appeal to your entire newsletter list, do you scrub that list for zip codes in states where you aren't currently registered?
I definitely do not know many development directors who do that. They just hit send all.
Of course they do. They hit send all. And if that list happens to include 50 people in Florida, 20 in Maryland, and maybe 100 in Washington State, well, congratulations. You have just actively solicited in 3 highly regulated states because you pushed it to them, right? You didn't just stumble into it. You sent a targeted communication to residents of those specific states asking for their money. And that is the textbook legal definition of solicitation.
And regulators exist to protect those residents from fraud, which is why they care so much.
Exactly. They are consumer protection agencies. They aren't trying to micromanage your nonprofit's internal daily operations. They just want to ensure transparency for the donors living in their state boundaries.
Which makes sense, but this leads us perfectly into the concept of what we call the accidental multistate fundraiser.
Oh, this happens all the time.
Right. An organization starts totally local, they are doing great work, they are fully compliant in their home state, everything is above board. But then this kind of geographical drift happens.
The drift is very real. And honestly, it is usually driven by your best, most loyal donors.
Give me an example of how that plays out. Sure.
Let's say you have a major donor, right? They retire and they decide to move from Chicago down to Naples, Florida. They still absolutely love your mission. They still want to give. So your team sends them their usual annual renewal letter.
And boom, you have now solicited in Florida.
You have. You sent mail across state lines asking for money.
And Florida is definitely not a state you want to mess around with. They have some pretty rigorous statutes down there.
Very rigorous. And here is where the simple paperwork turns into a massive compliance nightmare. It isn't just that you sent one letter. It's that if you keep soliciting, that specific donor and they keep giving, you are establishing a clear pattern of activity.
The state sees that as an ongoing relationship. Right.
The state regulator looks at that and says, "You are availing yourself of the generosity of our residents.
You need to be registered here." But how do they actually catch you? That is the cynicism I hear from nonprofit boards all the time. They say, "Okay, sure, we technically broke a rule in Florida, but unless that donor actively turns us in, who is going to know?" I hear that too.
But it is rarely donor turning you in. It is the paper trail that you create yourself.
It's a 990.
Exactly. Think about your IRS Form 990, specifically Schedule G. Mm-hmm. You have to list the states where you are registered or licensed to solicit.
And that is a federal document.
It is a federal document, and more importantly, it is publicly available on highly trafficked sites like GuideStar or Charity Navigator. Anyone can pull it up.
So if a state regulator in, let's say, Mississippi decides to pull your 990 and they see you raised $50,000 from Mississippi residents, but the box for MS isn't checked on your Schedule G list, then you have literally handed them the evidence of your own non-compliance.
Regulators are getting much smarter, and they're using data analytics and automated sweeps just like we use in the private sector.
That's terrifying.
Plus, you always have the disgruntled stakeholder factor to worry about.
Oh, right.
A fired employee, or maybe an unhappy board member who knows the rules, can very easily drop an anonymous tip to an attorney general's office. It honestly happens more often than you would think.
That is a really sobering thought. Okay, so let's pivot slightly to the messiest part of this whole equation. The internet.
The Wild West.
Truly, because traditional solicitation laws were written for direct mail and door-knocking campaigns. Geography used to be simple, but the internet respects zero borders. How do regulators navigate this now? We have the Charleston Principles, but those are from what, 2001?
2001, yes. Which is basically a lifetime ago in tech years.
Pre-social media.
Way before. But they still remain the primary guidance we have from regulators. The Charleston Principles were essentially an attempt by state charity officials to sit down and say, okay, we obviously cannot regulate the entire internet, so let's set some realistic ground rules.
And that is where they introduced the distinction between passive and targeted activity, right? Exactly.
That is the core distinction you have to understand. Passive versus targeted.
Let's really break that down for the listener because I feel like the word passive is the shield that every single nonprofit tries to hide behind. Like, oh, we're just passive on the web. We don't need to register anywhere else.
Right. Everyone claims they are passive. So passive generally means you have a website and it has a donate button, but you are not doing anything to specifically drive traffic to that site from outside your own home state.
It's just sitting there.
Exactly. You are like a billboard in your own physical town. If someone from out of town happens to drive by and sees it, well, that's on them. Under the Charleston principles, purely passive activity usually does not trigger registration requirements in other states.
But it comes with caveats.
With a few major caveats. Yes, because the word usually is doing a lot of heavy lifting there.
Because the moment you move to targeted activity, that passive shield completely drops.
It vanishes. And the reality is, in 2024, almost everything we do as marketers is targeted. If you send an email, targeted. If you run a digital display ad, targeted.
Okay. What about social media algorithms? Because this is a question I hear constantly from finance teams. Let's say I boost a post on Facebook. Okay. I go in and I set the audience to, let's say, people interested in environmental conservation. I do not pick a specific state. But Facebook's algorithm decides the absolute best people to show this ad to are sitting in California and New York. Right. I didn't consciously choose those states. Am I legally liable for soliciting there?
This right here is the absolute frontier of compliance right now.
Mm-hmm.
The argument from the state regulators is this: you chose to use a platform that distributes content nationally.
You knew what the tool was.
Exactly. You cannot just blame the algorithm. If you paid money for placement and that placement landed in New York, then New York considers that a targeted solicitation. You essentially authorized the platform to go find those out-of-state donors for you.
So the whole "I didn't know where the ads would run" defense, that just does not hold water anymore.
Not really, no. If you are putting money behind the ask, you are responsible for where that ask lands. This is exactly why we constantly tell finance teams to check their Google Analytics.
You have to know your data.
You really do. Yeah. Check your digital ad reports. Where's your web traffic actually coming from? Because if 40% of your site traffic is coming from California, you clearly have a substantial connection to California regardless of whether you ever mailed a physical letter there.
And California is a beast of its own when it comes to regulation.
Oh, absolutely.
Let's talk about the success trigger though, because it's not just about the act of asking. It is also about what happens when your passive website actually succeeds.
Right, this is the irony of the whole system. The Charleston Principles explicitly state that even if your website is purely passive, if you receive substantial or repeated and ongoing contributions from residents of a specific state, you have to register there.
As you get more successful, your compliance burden automatically grows. Is the word substantial legally defined across the board?
No, and that is what makes it maddening. It varies wildly by state. But generally speaking, if you are processing recurring monthly donations from a little cluster of donors in a specific state, regulators view that as repeated and ongoing.
Because it's a subscription, essentially.
Right. You are actively maintaining a financial relationship with the residents of that state. Therefore, you need to be registered.
Okay, let's shift gears and talk about accelerants. We have covered the slow accidental drift, but there are specific actions that organizations take that are effectively holding up a giant neon sign to regulators saying, please audit me right now.
Yes, there are definite fast tracks to trouble.
And the absolute biggest one has to be hiring professional help.
Oh, without a doubt. This is what we call the pro trigger, hiring a fundraising consultant.
And we need to be really specific with our terminology here for you listening. We aren't just talking about hiring a freelance grant writer to do some backend work. We are talking about hiring fundraising counsel or professional solicitors.
Correct. And that legal distinction matters immensely. A professional solicitor is an individual or a firm who actually asks for the money on your behalf. Think of a telemarketing firm.
Right.
But fundraising counsel is someone who advises you on your strategy. They manage your campaign rollout or they write your appeal copy, but they don't actually make the ask themselves.
But they both trigger compliance issues.
Yes. In many, many states, both of those roles trigger immediate registration requirements for the nonprofit.
And here is the trap that catches so many people off guard. The consultant themselves is usually legally required to file their contract with the state.
Exactly. The consultant is a business. They want to protect their own operating license.
Mm-hmm.
So they proactively file a document with, say, the state of Pennsylvania saying, I have just entered into a contract to consult for XYZ nonprofit.
And then the state clerk gets that document. Right.
The clerk gets it. They look up XYZ nonprofit in their database. And they see absolutely nothing, you aren't registered.
Bam! Automatic Notice of Violation in the mail.
It is almost immediate. And the problem is, now you aren't just registering voluntarily on your own timeline, you are registering defensively in response to an official inquiry.
Which means penalties.
Exactly. It often means paying back fees, late fines, and effectively admitting on the record that you were soliciting without a license.
Which is just a terrible look for any organization.
It really is. Now, another huge accelerant we see is peer-to-peer campaigns.
Oh, like Giving Days.
Giving Days, or when you ask your volunteers to start their own personal fundraising page for your cause. When you do that, you have effectively deputized a massive nationwide sales force.
And you have zero control over where they send those links.
None at all. Your well-meaning volunteer in Ohio sends their personal donation link to her aunt in New Jersey. And her old college roommate down in Texas.
And suddenly you are actively soliciting in New Jersey and Texas.
Exactly.
Okay, so we have firmly established that it is incredibly easy to accidentally trigger these legal requirements. Now I want to push back a little bit on the "so what" factor.
The risk analysis.
Right. Because I know exactly how finance directors think. They look at the sheer cost of compliance, hiring a legal firm to manage it, paying the individual state fees. So they compare that guaranteed expense to the vague threat of a potential $500 fine from a state and they think, you know what, I will just take the risk.
I see that all the time. That is what I call the parking ticket mentality. People think, I'll just pay the ticket if I happen to get caught. But in the nonprofit regulatory world, the consequences aren't just minor fines. The real currency you lose is your good standing.
Explain the impact of losing good standing, because to a layperson, that just sounds like a bureaucratic slap on the wrist, but it actually has some serious teeth.
It has very sharp teeth. Good standing means the state formally recognizes you as a valid, compliant legal entity. If you lose that status or if you never actually had it to begin with, it stops your operations cold.
Give me a real-world consequence.
Grants. This is the big one. Many large institutional foundations now strictly require a certificate of good standing from your home state and sometimes even the target state before they will release a single dollar of funds.
So you do all the work, you win a $100,000 grant, but the check is held hostage because you didn't pay a $50 state registration fee.
Exactly. It happened more often than you would think.
Yep.
Or consider the Unified Registration Statement myth.
Oh, the URS.
Right. People think, oh, I will just fill out this one master form and be done with it. But the URS is practically dead. Many states just do not accept it anymore, or they require so many specific addendums that the master form is useless. If you mess that paperwork up, your status gets rejected.
It's a mess. That is such a critical point. It is not just about the state fee. It's about all the regulatory baggage that gets dragged in along with the fee.
Absolutely.
And let's not forget the board members in all this. Does this regulatory blowback ever land on them personally?
In extreme cases, yes, it can. Soliciting without a license is a violation of state consumer protection law. Mm. If an organization is found to be grossly negligent, like if you are actively ignoring cease and desist orders from an attorney general, for instance, board members can sometimes be held personally liable in certain jurisdictions.
Wow.
It is rare, but honestly, do you want to be the board chair trying to explain to your professional peers why the state attorney general is sending demand letters to your home address?
No, you definitely do not. That is a fast track to a career-limiting move. Exactly. So we have painted a pretty stark picture here today. It is a regulatory minefield, but we need to give you, the listener, a way out of the maze. We need a workflow, a plan of action, right? If you are a CFO listening to this right now and you are starting to panic just a little bit, what is your practical Monday morning checklist?
First rule, don't panic. Just start gathering your data. You need to conduct an internal solicitation audit.
Where do they start?
First, look at your revenue by state. Just run a simple geographic report in your CRM. Where's the money actually coming from right now? If you have zero donors in a specific state, you're probably very low risk there, provided you aren't actively running targeted ads there.
Okay, so step one is the revenue map. What is step two?
Step two is analyzing your ask footprint. Look at your email marketing service provider. Where are your current subscribers physically located? Look at your digital ad spend from the last year. Are you proactively geofencing your ads to states where you are compliant, or are you just letting them run wild across the whole country?
And they should probably check their website footer too, right?
Yes, absolutely. Does your website have all the legally required disclosure statements? Many states require very specific boilerplate language on all of your solicitation materials.
Like the statement saying, "A copy of our official financial report is available from the Secretary of State," and so on.
Exactly. If that specific language is completely missing from your donation page, That is an incredibly easy red flag for a state regulator to spot.
And then I assume you take that revenue map and that footprint analysis and you compare it to your current active registrations, right?
If you have significant revenue or high digital activity in a state where you are not currently registered, that is your red zone.
You have to prioritize those immediately.
Yes. You don't necessarily have to panic and register in all 41 states by tomorrow morning. Start with the states where you have the absolute highest exposure, either because you have the most donors there or because they are known for having the strictest enforcement laws.
You mean states like California, New York, Florida, Pennsylvania, Illinois?
Exactly. The big regulators. Get right with them first. Once you are secure there, then look at the second-tier states. And you really have to be honest with yourself about your growth plans.
Look ahead.
Yes. If you are planning a massive national digital campaign for next quarter, You need to get the state registrations in place right now. It can take weeks or even months for some states to actually process this paperwork.
You definitely do not want to launch a huge, expensive campaign and then get a cease and desist letter in week 2 because your paperwork is stuck in a backlog.
It happens and it ruins campaigns.
Let's quickly talk about the maintenance aspect before we finish up, because getting registered initially is one thing. Staying registered over the long term is another circle of hell entirely.
It is a relentless operational grind. I won't sugarcoat it. It is never a one-and-done situation. Most states require annual renewals and the due dates are completely uncoordinated, right?
Some are based on your specific fiscal year end and some are just arbitrary fixed calendar dates.
And the actual forms change constantly. Plus, as we mentioned earlier, the financial reporting requirements scale up as you succeed. As your nonprofit grows from $500,000 to $2 million in revenue, you graduate from simple postcard reporting to complex audited financial reporting.
You really need a robust system.
You do. If you are trying to manage 30 different state registrations and deadlines on a single Excel spreadsheet, you are eventually going to fail. You will miss a random deadline. You will get hit with a late fee and you will suddenly lose your good standing right when you need it most.
Honestly, this sounds like a massive argument for outsourcing the whole process.
For a lot of mid-sized organizations, yes. It really is. Unless you have a dedicated full-time compliance officer on staff, it is incredibly hard for a generalist finance director to keep up with the constantly changing requirements of 40+ different legal jurisdictions.
Before we wrap up today's deep dive, I want to touch on the bigger why. Okay. We have spent a lot of time talking about the stick today, the fines, the forced audits, the fear of losing grants. But is there a carrot here? Does actively being compliant actually help an organization raise more money?
I strongly believe it does. Look, we are living in an era of intense public skepticism. Donors are much more savvy now than they were 20 years ago.
They do their homework.
They do. They look up your profile on Charity Navigator. They look at GuideStar. They want concrete assurance that their money is safe and being used properly.
So is transparency play?
Exactly. When a major donor sees that you are properly registered across the board, that you have all your legal disclosure statements clearly visible on your website, and that you are embracing transparency, it signals institutional maturity.
It says we are a serious professional operation, right?
It says we take your trust seriously enough to do the boring paperwork.
It really is a powerful trust signal.
Exactly. It fundamentally differentiates you from the amateur fly-by-night operations out there. It removes a subconscious barrier to giving. You never, ever want a prospective donor to hesitate because they Googled your organization and found a not in good standing flag on some state government website.
Because that is a donation you will never get back.
Never. They will just move on to the next charity.
That is a really strong point to end on, but I want to leave you with one final thought to mull over. We've talked about transparency as a legal hoop and as a donor trust signal. But think about where the sector is heading with the next generation of major donors.
Millennials and Gen Z.
Exactly. These younger generations are digital natives and they expect radical transparency as a baseline. They're used to vetting everything online before they spend a dime. If your compliance isn't airtight and easily verifiable online, you aren't just risking a state fine. You might be algorithmically and culturally invisible to the future of philanthropy. Compliance isn't just overhead anymore. It is active brand protection for the next decade.
I couldn't agree more. Compliance really just follows growth. If your finance team is suddenly having to worry about registering in 20 different states, take a moment to actually celebrate that.
Right. It means it's working.
It means your mission is resonating across state lines. That is a huge victory. Now you just have to do the administrative paperwork so you can legally keep that victory.
Well, there you have it. It might not be the most glamorous part of saving the world, but it is undeniably one of the most important factors for keeping your doors open. We've gone from the digital drift of the Charleston Principles through the scary reality of forced audit thresholds, and hopefully we've given you a solid framework to get your own house in order.
Thanks for diving into the details with me.
If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.
More from Steve
Which States Have the Most Complex Charitable Solicitation Registration Requirements?
