Common Myths About Nonprofit Compliance

SPEAKER_00 (0:00): Welcome to the Nonprofit Compliance Brief, where we explain charitable solicitation and multi-state fundraising requirements in clear, practical terms for nonprofit leaders and finance teams. This podcast is produced by Ironwood Registrations.

SPEAKER_01 (0:14): Thanks. It’s really great to be here.

SPEAKER_00 (0:16): So today we are going to dive into something that I think probably haunts every Executive Director and CFO out there, whether they actually want to admit it or not: the “unknown unknowns.” We’re doing a deep dive into the mythology of compliance. It’s that game of telephone where a board member tells you, “Oh, hey, my friend runs a charity and they don’t have to register in Florida,” and then suddenly that becomes your internal policy.

SPEAKER_01 (0:42): Yeah, the classic “cocktail party legal advice.” It is an incredibly pervasive problem in the sector.

SPEAKER_00 (0:48): It really is. In a lot of industries, bad advice just leads to a bit of inefficiency. But here, we’re talking about actual legal standing. We’ve pulled together data, state statutes, and common enforcement patterns to look at the gap between what nonprofit leaders think the law is and what the law actually is.

SPEAKER_01 (1:11): And that gap is usually a lot wider than people think. But we have to start with a little empathy here. The reason these myths exist isn’t because nonprofit leaders are lazy; it’s because the system is objectively chaotic. You have 40-plus states with registration requirements, different revenue thresholds, different forms, different due dates, and rules that were written way before the internet even existed. People use heuristics—mental shortcuts—just to make sense of the noise.

SPEAKER_00 (1:48): Right, but relying on those shortcuts feels increasingly risky for organizations today.

SPEAKER_01 (1:52): It is super risky. The danger isn’t usually that the shortcut is a flat-out lie; it’s usually a partial truth. Maybe it was true 10 years ago, or it’s true in one specific context but not yours. When you build your whole organization’s risk profile on a partial truth, you’re building a house on sand.

SPEAKER_00 (2:12): And the stakes here—this isn’t just about getting hit with a $50 late fee.

SPEAKER_01 (2:19): No, not at all. We are talking about your actual legal ability to solicit funds. We’re talking about your reputation. If an Attorney General sends a cease-and-desist letter, or if a watchdog group flags you for being unregistered, that hits your donor trust incredibly hard. And for the finance teams, it creates a massive unexpected liability. You do not want to be explaining to your auditor why you suddenly have five figures in accrued penalties.

SPEAKER_00 (2:49): Nobody wants that meeting. So our mission today is high-stakes myth-busting. We’re going to dismantle the six most common compliance myths and replace them with the actual infrastructure you need.

Myth #1: The “Small Org” Fallacy

The Myth: “We only have $5,000 in the bank. We are way too small to matter to the state of New York or California.”

SPEAKER_01 (3:25): This is the one I hear most often. It appeals to our sense of fairness—it feels like the law should just leave the little guys alone. But the hard reality is that regulatory obligations are triggered by activity, not just your revenue.

SPEAKER_00 (3:41): Activity, meaning just the act of asking?

SPEAKER_01 (3:44): Bingo. The trigger phrase in most state statutes is solicitation. Whether you raise a million dollars, $10, or zero dollars, the state is interested in the fact that you asked. If you send an email appeal and get crickets, you still might have broken the law if you weren’t registered.

SPEAKER_00 (4:35): But don’t some states have waivers for very small organizations?

SPEAKER_01 (4:38): It’s not a loophole; it’s a process. In many of those states, you have to actually apply for that exemption. You can’t just stay silent. If you don’t file that piece of paper, you aren’t exempt—you are just unregistered.

SPEAKER_00 (5:27): It feels backwards to the business brain. You want to validate the market before you build the administrative infrastructure.

SPEAKER_01 (5:35): It’s backwards to the business brain, but logical to the consumer protection brain. The state doesn’t want you scamming people, regardless of your size.

The Relationship Between Growth and Compliance

SPEAKER_00 (6:01): It seems like a lot of leaders view compliance as a static box—register once and you’re done.

SPEAKER_01 (6:06): That’s a recipe for disaster. Compliance tends to expand alongside fundraising growth. It’s like a shadow that grows with you. If you start out local, you only need your home state. But the minute you get a grant from a foundation in another state or run a direct mail campaign in a tri-state area, your requirements shift. Organizations that review requirements periodically—checking in every year—avoid most problems.

Myth #2: The Digital Loophole

The Myth: “The internet is borderless. If I put a donate button on my website, I’m just existing on the web. Surely those old laws from the 1980s don’t apply.”

SPEAKER_01 (7:21): Comforting, but legally incorrect. We have to talk about the Charleston Principles.

SPEAKER_01 (7:34): This is the standard most states use to interpret when a website counts as solicitation. It distinguishes between passive and active digital presence. Having a passive website sitting there might not trigger registration everywhere. But if you are targeting donors—sending emails to people in that state, running geotargeted Facebook ads, or receiving substantial repeated contributions—you have established a Nexus.

SPEAKER_00 (8:52): So if I put a button up and don’t tell anyone, maybe I’m okay. But the moment I tweet about it, the clock starts ticking?

SPEAKER_01 (9:03): In the eyes of many regulators, yes. When you drop a letter in the mail, you know it went to Ohio. When you tweet, it goes to the entire world. You have to accept that your regulatory footprint is going to be national very quickly.

Myth #3: The Home-Based Bias

The Myth: “We are a Chicago nonprofit. Our office is here, so we register in Illinois and we’re totally good.”

SPEAKER_01 (9:55): That’s a brick-and-mortar mindset hangover. The regulators in Pennsylvania do not care where you are; they care where the donor is. It goes back to consumer protection.

SPEAKER_00 (10:25): And this gets complicated because of the need for a Registered Agent, right?

SPEAKER_01 (10:34): Yes. Many states require you to have a physical address there to accept legal service. Since you don’t have an office in all 50 states, you have to hire a service—a Registered Agent—to act as that address for you. If you forget to budget for the agent, the filing fees, and the annual reports for 20 other states, you will severely under-resource your finance team.

Myth #4: The Federal Umbrella

The Myth: “We got our 501(c)(3) letter from the IRS. That covers everything.”

SPEAKER_01 (12:02): It’s a painful realization when they find out it doesn’t. The IRS and State Attorneys General are playing two completely different sports.

• The IRS: Concerned with tax status. Should we allow you to avoid federal income tax?
• State Governments: Concerned with solicitation. Are you telling the truth? Are you using the money as promised?

SPEAKER_00 (12:50): So it’s like having a driver’s license doesn’t mean your car is automatically registered.

SPEAKER_01 (12:54): Exactly. You file your Form 990 with the IRS, but most states require you to submit that exact same 990 to them as well, along with their own specific state forms. You need the raincoat, which is the state registration, too.

Myth #5: The Tech Savior Myth

The Myth: “We use a big crowdfunding platform or donor software. They handle all the compliance for us.”

SPEAKER_01 (13:35): I wish. The platform handles transactional compliance (PCI security, sending a tax receipt), but they explicitly do not handle solicitation compliance.

SPEAKER_00 (14:03): Let me guess—it’s in the fine print?

SPEAKER_01 (14:05): Always. It usually says “compliance with local laws is the sole responsibility of the user.” Think of the tech platform as a megaphone. If you use a megaphone to shout at people at 3:00 a.m., you can’t blame the hardware store for your noise complaint.

Myth #6: The Reactive Mindset

The Myth: “If it ain’t broke, don’t fix it. I’ll worry about it when I get a scary letter from the Attorney General.”

SPEAKER_01 (15:33): That is Russian roulette. By the time you react, the damage is already done. We’re talking about operational friction and lost opportunity. If a foundation checks the state database and sees your status is “delinquent,” they pull the check. Compliance isn’t just about avoiding jail; it’s about building infrastructure.

SPEAKER_00 (16:26): Infrastructure. It actually holds the building up.

SPEAKER_01 (16:46): It supports donor trust and solid governance. When you are “due diligence ready,” you breeze through grant applications. You aren’t scrambling to answer subpoenas. It changes your finance team from crisis management to standard operations.

The Psychology of Compliance

SPEAKER_01 (16:55): The real barrier here is fear of the unknown—the monster under the bed. When you understand the rules, the monster disappears. It just becomes another item on a checklist.

SPEAKER_00 (17:30): And that has a huge impact on leadership bandwidth.

SPEAKER_01 (17:30): Massive. The Executive Director can stop looking over their shoulder and focus on the mission. You cannot save the world if you are terrified of your own mailbox. Discipline creates freedom.

Summary and Takeaways

SPEAKER_01 (18:07): Stop viewing compliance as a penalty for success and start viewing it as the essential infrastructure for success. If your burden is getting heavier, it usually means you are winning.

The Monday Morning To-Do List:

1. Audit your assumptions. If you are operating on a rule you heard at a conference five years ago, check it.
2. Document your processes. Don’t let knowledge live entirely in one person’s head.
3. Create shared organizational awareness. The development team needs to talk regularly to the finance team.

SPEAKER_01 (19:05): Compliance is almost always less intimidating than it appears once the myths are stripped away. Moving forward with clarity builds stability and trust.

SPEAKER_00 (19:31): It’s not the monster; it’s just the shadow of a monster. If you found this discussion helpful, you can find additional compliance guides and visual resources at ironwoodregistrations.com. Thanks for listening.