Cybersecurity protects your systems. Cybersecurity risk management protects your business.®
Client PortalToll Free: +1 (800) 835-2302Regional: +1 (916) 333-1062
Schedule a Call
Phone: +1 (916) 333-1062

LBT TECHNOLOGY GROUP | Grant, CDFI & Public Funding Compliance

Federal Grant, CDFI Fund & Public Funding Data Handling Requirements for Nonprofits

lbttechgroup.com · +1 (916) 333-1062 · Sacramento, California · Veteran-Owned

What are grant & CDFI data compliance requirements?

Federal and CDFI funders have moved data compliance from grant condition to enforceable obligation.

Federal grant-making agencies and the Community Development Financial Institutions Fund (“CDFI Fund”) have progressively formalized data handling, records retention, and reporting requirements for the nonprofits and CDFIs they fund. Sacramento-area nonprofits receiving federal grants, CDFI Fund awards, or other public funding face obligations under 2 C.F.R. Part 200 (“Uniform Guidance”) and CDFI Fund program requirements—obligations that are tested through Single Audits, CDFI Fund monitoring reviews, and funder site visits.

The stakes are real: organizations that expend $750,000 or more in federal awards annually must undergo a Single Audit under Uniform Guidance Subpart F. Certified CDFIs must file Annual Certification and Data Collection Reports (ACR) and Transaction Level Reports (TLR) through AMIS, and report Material Events within 30 days. For Sacramento-area nonprofits, these are not theoretical federal concerns—they determine whether an organization keeps its funding.

Who must comply

The Sacramento-area nonprofits and CDFIs in scope for federal and CDFI Fund requirements.

Key grant & CDFI compliance requirements

The specific requirements funded organizations must satisfy.

The 30-day Material Event window

The CDFI Fund's most demanding compliance requirement.

Single Audit & CDFI monitoring priorities

What auditors and funders specifically look for.

California-specific requirements

What changes for Sacramento-area nonprofits under California law.

How LBT supports grant & CDFI compliance

A managed program built to satisfy federal and CDFI Fund expectations.

Is Your Nonprofit Grant & CDFI Ready?

Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them—at no cost and no obligation.

This document is for informational purposes only and does not constitute legal, audit, or compliance advice.

Grant, CDFI & Public Funding Compliance

Federal Grant, CDFI Fund & Public Funding Data Handling Requirements for Nonprofits

Federal and CDFI funders have moved data compliance from grant condition to enforceable obligation.

Book Your Free Grant & CDFI Compliance AssessmentSchedule a Call
$750K+Single Audit trigger threshold (annual federal expenditures)
30 DaysCDFI Fund Material Events reporting window
3 YearsMinimum federal records retention post-award
AnnualACR & TLR filing requirement for CDFIs

What are grant & CDFI data compliance requirements?

Federal and CDFI funders have moved data compliance from grant condition to enforceable obligation.

Federal grant-making agencies and the Community Development Financial Institutions Fund (“CDFI Fund”) have progressively formalized data handling, records retention, and reporting requirements for the nonprofits and CDFIs they fund. Sacramento-area nonprofits receiving federal grants, CDFI Fund awards, or other public funding face obligations under 2 C.F.R. Part 200 (“Uniform Guidance”) and CDFI Fund program requirements—obligations that are tested through Single Audits, CDFI Fund monitoring reviews, and funder site visits.

The stakes are real: organizations that expend $750,000 or more in federal awards annually must undergo a Single Audit under Uniform Guidance Subpart F. Certified CDFIs must file Annual Certification and Data Collection Reports (ACR) and Transaction Level Reports (TLR) through AMIS, and report Material Events within 30 days. For Sacramento-area nonprofits, these are not theoretical federal concerns—they determine whether an organization keeps its funding.

Who must comply

The Sacramento-area nonprofits and CDFIs in scope for federal and CDFI Fund requirements.

01

Federal Grant Recipients (Direct)

2 C.F.R. Part 200 Subparts D & F; Single Audit if $750K+ in annual federal expenditures; agency-specific award terms.

02

Federal Grant Subrecipients

Subrecipient monitoring flows down from the pass-through entity; same records retention and reporting obligations as direct recipients.

03

Certified CDFIs

Annual Certification and Data Collection Report (ACR), Transaction Level Report (TLR) via AMIS, Material Events reporting within 30 days.

04

CDFI ERP Award Recipients

Demographic data collection and segregation requirements under Section 523(d), Consolidated Appropriations Act, 2021.

05

Health & Human Services Grant Recipients

HIPAA Privacy & Security Rules where Protected Health Information is collected or stored.

Key grant & CDFI compliance requirements

The specific requirements funded organizations must satisfy.

01

2 C.F.R. Part 200—Uniform Guidance

Uniform Guidance requires recipients and subrecipients of federal awards to maintain financial and program records traceable to the specific award, retain those records for a minimum of 3 years after submission of the final financial or performance report, and maintain internal controls sufficient to support a Single Audit under Subpart F.

02

CDFI Fund Reporting—ACR & TLR via AMIS

Certified CDFIs must submit Annual Certification and Data Collection Reports and Transaction Level Reports through the CDFI Fund's AMIS system (successor to CIIS) within the timeframe specified in their award agreement—generally within six months of fiscal year-end. Underlying records supporting these filings must be preserved and producible on request.

03

CDFI ERP Demographic Data Rules

CDFI Economic Recovery Program award recipients must collect and report race and ethnicity data for borrowers, investees, and grantees funded with the award. Section 523(d) of the Consolidated Appropriations Act, 2021 permits this collection notwithstanding standard Equal Credit Opportunity Act limits—but that same data must be walled off from underwriting and credit-decision workflows.

04

Single Audit—Uniform Guidance Subpart F

Organizations expending $750,000 or more in federal awards in a fiscal year must undergo a Single Audit examining internal controls, compliance, and financial reporting across all federal award programs. Auditors routinely request evidence of records retention, access controls, and subrecipient monitoring documentation.

The 30-day Material Event window

The CDFI Fund's most demanding compliance requirement.

CDFI Fund award and allocation agreements generally require Material Events—mergers, loss of certification eligibility, leadership changes, and similar events—to be reported within 30 days of occurrence. This timeline requires the organization to recognize a reportable event as it happens, not after a routine annual filing surfaces it.

Single Audit & CDFI monitoring priorities

What auditors and funders specifically look for.

Single Audit reviewers and CDFI Fund monitoring visits consistently test the same set of controls. The following are routinely requested during federal award compliance reviews:

Records retention evidence

Documentation traceable to the specific award, retained for the required period.

Access controls

Evidence of role-based access and segregation of demographic data from underwriting workflows.

Subrecipient monitoring documentation

For pass-through entities, evidence that subrecipients are monitored and compliant.

Written data handling summary

Current, and reflecting how Public Funding Data actually moves through the organization's systems.

Incident / Material Event response plan

Documented, tested, and calibrated to funder-specific notification timelines.

Financial system traceability

Ability to tie expenditures back to the specific award for audit sampling.

Sub-processor / vendor disclosures

Documentation of any third party with access to Public Funding Data.

California-specific requirements

What changes for Sacramento-area nonprofits under California law.

Federal rules aren't the only thing in scope. California layers its own requirements on top—some of them stricter, and one of them significantly faster than most federal grant terms.

Data Breach Notification

As of January 1, 2026, affected California residents must be notified within 30 calendar days of discovery—with the Attorney General notified 15 days after that. Breaches affecting 500+ residents require an electronic sample notice to the AG.

CCPA / CPRA

Nonprofits are generally exempt as they don't meet the statutory definition of a “business.” The exemption does not extend to a for-profit subsidiary or co-branded affiliate that independently meets CCPA thresholds.

COIN State CDFI Certification

Separate from U.S. Treasury CDFI Fund certification. COIN-certified CDFIs face their own reporting line under Insurance Code § 12939.1 and a 5-year record retention requirement tied to the certification.

AG Registry of Charitable Trusts

Annual RRF-1 renewal is a standing nonprofit obligation, independent of grant/CDFI data rules—but the underlying records benefit from the same retention and access discipline as Public Funding Data.

How LBT supports grant & CDFI compliance

A managed program built to satisfy federal and CDFI Fund expectations.

01

Written Data Handling Summary & Annual Review

Development and annual review of a written Data Handling Summary documenting how Public Funding Data is stored, processed, and safeguarded—maintained as a living document funders and auditors can review on request.

02

Records Retention Aligned to Award Closeout

Backup and retention schedules configured to the funding-specific retention period (generally 3+ years post-final-report) rather than Provider's standard default policy.

03

Material Event & Incident Response Readiness

Incident response procedures calibrated to a 24-hour internal notice to Client and funder-specific reporting windows—including the CDFI Fund's 30-day Material Events requirement.

04

Single Audit & Uniform Guidance Support

Documentation and system configuration support for Single Audit data requests under Uniform Guidance Subpart F, including financial record traceability to specific awards.

05

CDFI ERP Demographic Data Segregation

Field-level access controls separating demographic data from underwriting and credit-decision workflows, restricted to authorized personnel only.

06

Subrecipient & Sub-Processor Risk Management

Formal disclosure and review process for any Sub-Processor or subrecipient system with access to Public Funding Data.

Related LBT services

Explore related services on our website.

Governance, Risk & ComplianceManaged Risk & SupportMicrosoft 365 Security MonitoringBackup & Disaster Recovery

Is your nonprofit grant & CDFI ready?

Book your free Grant & CDFI Compliance Assessment.

Schedule a complimentary scoping consultation. LBT will assess your current compliance posture, identify gaps, and show you exactly what it takes to close them—at no cost and no obligation.

Book Your Free Grant & CDFI Compliance AssessmentSchedule a Call
This document is for informational purposes only and does not constitute legal, audit, or compliance advice.