2 CFR 200 Uniform Guidance, IRS Form 990 and Publication 1771 Receipting, State Charitable Solicitation Registration, and PCI-DSS: Compliance for US Nonprofit Software

Which of These Apply Depends on Your Funding and Your Form

Four compliance surfaces shape a nonprofit platform. Unusually, what applies depends on two things about the organization rather than on what the software does. Federal award requirements apply to organizations receiving federal funding, directly or as a subrecipient. Organizations funded entirely by private philanthropy do not carry them.

Receipting and substantiation apply to any organization accepting contributions. Charitable solicitation registration applies wherever an organization asks for money. An online giving page raises questions in more states than it operates in.

Approval steps, records, controls, and audit trails can all be built into everyday workflows through custom software development. Donation pages present required information and capture the records needed for compliance when they’re built through careful web application development.

The private foundation excise rules apply only to private foundations, an important distinction, since public charities are not subject to them.

Federal uniform requirements have changed, while older figures still appear in widely available guidance. Verify current thresholds and rates before relying on published figures.

This article provides educational information and does not constitute legal, tax, or accounting advice. 

2 CFR 200 Uniform Guidance

What It Governs

The uniform requirements cover federal awards across three areas: administrative requirements, cost principles, and audit requirements. Together, these reach almost everything a platform does with federal money.

That includes which costs are allowable, allocable, and reasonable; how procurement must be conducted; and which changes require prior approval. It also includes what records support each charge and what happens at closeout.

The Figures That Changed

The requirements were substantially revised recently. The Single Audit threshold rose from $750,000 to $1,000,000 in annual federal expenditures. That change took effect for fiscal years beginning on or after October 1, 2024. The de minimis indirect cost rate also changed. 

It rose from 10% to as much as 15% of Modified Total Direct Costs. That change took effect on the same date. Both figures still appear at their old values in material published before the revision. Confirm which fiscal year applies before using either number.

What the Platform Must Support

Award terms belong on the award record, not a separate file. The budget by cost category needs to be visible by line. Cost classification should support allowability, and personnel records need to be kept. Prior approval tracking and procurement documentation matter wherever thresholds apply.

Reporting calendars need to cover both financial and programmatic obligations. And the record needs to be complete enough for an auditor. For any transaction sampled, they should see what it was, which award it was charged to, and what authorized it.

Personnel Costs and Subrecipient Monitoring

Two areas within federal award administration are more software-dependent than the rest, and both are where audit findings often arise.

First, personnel costs charged to federal awards must be supported by records reflecting the work actually performed. Most program staff at a grant-funded nonprofit work across several funding sources. That means allocation supported by records, not a budgeted percentage all year.

The practical requirement is a system where staff record effort against funding sources on a regular cycle. Someone with knowledge of the work certifies it. Charges then reconcile to what was recorded. Getting this wrong is a common audit finding. Making that cycle easy for program staff working away from a desk is where custom mobile app development fits into the platform.

Subrecipient monitoring is the second area. An organization passing federal funding to another entity carries responsibility for that entity’s compliance. That starts with whether the relationship is a subaward or a contract, a determination with different consequences.

Where it is a subaward, risk assessment comes first, then proportionate monitoring, then reviewing the subrecipient’s reports and audit findings. Which steps apply depends on the specific award and its funding terms.

Form 990 and Publication 1771 Receipting

Two tax obligations reach the platform directly. The acknowledgment a donor receives is a tax document.

Contributions above a defined threshold require a contemporaneous written acknowledgment. It states the amount, whether goods or services were provided, and their value. Without it, the donor cannot substantiate the deduction.

Payments partly a contribution and partly for goods or services, above a defined threshold, need something more. That describes gala tickets, membership benefits, and event registrations. Disclosure limits the deductible amount to the excess over the value received.

These thresholds, $250 for a written acknowledgment and $75 for quid pro quo disclosure, have been fixed by statute since 1993. They don’t adjust for inflation. They rarely change, but Congress could revise them. Confirm against current IRS guidance whether a platform is hard-coding these values rather than treating them as configuration.

The software implication is direct. Benefit values need to be maintained as configuration attached to events and giving levels. Acknowledgments should be generated automatically and promptly, not at year-end.

The annual information return is the second obligation, and it is a public document. Its schedules cover contributors, fundraising events, and noncash contributions, each needing data captured during the year, not reconstructed later.

Noncash gifts, in particular, carry valuation and reporting requirements worth capturing at the point of receipt.

State Charitable Solicitation Registration

Most states require a charity soliciting contributions from residents to register and file annually. Thresholds, forms, fees, and exemptions vary considerably by state.

For an organization fundraising locally, this is usually manageable. An online giving page changes the question, since a nationally available page is soliciting wherever someone finds it.

State charity regulators developed guidance on when online solicitation triggers registration, distinguishing a passive presence from active targeting. That guidance remains the reference point, and the analysis stays fact-specific rather than settled.

Several states also require specific disclosure language on solicitations. That might mean where financial information may be obtained, or that registration implies no endorsement. A giving page may need different disclosures by the donor state.

Where an organization engages professional fundraisers or fundraising counsel, separate registration obligations may attach to them. Assess with counsel and build the disclosure layer as a state-aware configuration rather than a single footer.

Private Foundation Rules

Private foundations operate under a set of excise tax provisions that public charities do not. These rules shape what grantmaking software must support.

A minimum distribution requirement obliges a foundation to make qualifying distributions each year, based on the value of its assets. An excise tax also applies to net investment income. Tracking distributions against the requirement is a core reporting function, not an occasional analysis. 

Self-dealing rules prohibit most transactions between the foundation and its disqualified persons. That reaches grant decisions where a board member has a relationship with an applicant. Conflict of interest recording becomes a genuine requirement here, not just good practice.

Rules on jeopardizing investments and taxable expenditures constrain what may be funded. That includes obligations toward non-public-charity grants and restrictions on grants to individuals.

The platform supports four functions here. It verifies charitable status at screening and records conflicts during review. It tracks distributions against the requirement and generates the documentation that those obligations produce. 

Rates and thresholds in these provisions change over time. Tax counsel experienced in private foundation rules should confirm current figures before any decision relies on them.

PCI-DSS and Other Obligations

Payment card obligations apply across online giving, events, and recurring gifts with stored credentials. Tokenization and hosted payment handling keep the compliance environment small.

Bank-based recurring giving operates under network rules requiring proper authorization from the account holder. That authorization needs to be recorded and retained.

Donor data carries privacy obligations of its own, and anonymity preferences are frequently stronger than any legal requirement. A donor who asked not to be listed expects that to be honored everywhere, including recognition materials.

Accessibility applies to giving pages and applicant portals, since both are public-facing. Both exclude people when they are not accessible.

And record retention obligations attach to federal awards, frequently for years after closeout.

Building Compliance Into the Platform, Not a Binder

Organizations that hold award terms against the award and support personnel charges with real records end up ahead. The same goes for accurate acknowledgment values and knowing where the giving page actually solicits.

Those platforms survive an audit and serve donors properly. Verify the revised federal figures with your auditor. Confirm the rest with nonprofit counsel and, for foundations, tax counsel experienced in private foundation rules.

If you are scoping a platform for federal awards and tax acknowledgments, settle compliance requirements before architecture is fixed. That keeps compliance from becoming an audit finding. NewAgeSysIT helps organizations map these obligations to real product features before development starts. Learn more about digital transformation solutions from one of the leading AI software companies in the United States.