Nonprofits
Grant compliance and donor data protection
Threshold in 2 CFR 200.501(a), raised from $750,000 by OMB's 2024 revision of the Uniform Guidance.
Nonprofit organizations manage donor data and grant-funded programs with limited resources. Thalorin provides right-sized compliance infrastructure for nonprofits, addressing donor data protection, grant compliance requirements, and the security controls expected by major institutional funders.
A federal award can end because the agency changed its mind. 2 CFR 200.340(a)(4) permits termination pursuant to the terms and conditions of the award, including, to the extent authorised by law, where an award no longer effectuates the program goals or agency priorities. Executive Order 14332 of 7 August 2025, Improving Oversight of Federal Grantmaking, directs the Director of OMB to revise the Uniform Guidance so that all discretionary grants permit termination for convenience, and gave every agency 30 days to report whether its standard terms and conditions already carry those provisions.
Most organisations of any size sit on both sides of an award at once. As recipient they answer for 2 CFR 200.303; as a pass-through entity, 200.332 makes them responsible for evaluating each subrecipient's fraud risk, imposing specific conditions where warranted, reviewing financial and performance reports, and resolving audit findings tied to the subaward. Accepting the money also certifies compliance with 200.216, the Section 889 prohibition on covered telecommunications and video surveillance equipment — Huawei, ZTE, Hytera, Hikvision, Dahua — extending to any system that uses such equipment as a substantial or essential component.
What actually ends a fundraising programme is rarely an enforcement action. Under California Government Code 12599.9(d), a charitable fundraising platform may only enable solicitations for, or distribute donations to, organisations in good standing, and it may establish that from machine-readable lists published by the Internal Revenue Service, the Franchise Tax Board, and the Attorney General's Registry of Charities and Fundraisers. Exempt status is revoked by operation of law under 26 U.S.C. 6033(j)(1)(B) after three consecutive years without an annual return or notice. Nothing warns the platform, which reads the list and stops listing the organisation.
Right-sizing is a scoping decision, not a discount. Thalorin carries each obligation against the award, subaward, or registration that imposed it, so an organisation under the $1,000,000 single audit threshold in 2 CFR 200.501 runs the controls its awards actually require, and the reporting package that 200.512 puts on a clock is assembled from evidence already held rather than reconstructed once the auditor's report lands. A subaward issued onward carries its monitoring duties with it instead of leaving them to be remembered when a finding arrives.
Organizations face significant compliance challenges
Termination when priorities move
2 CFR 200.340(a)(4) allows termination where an award no longer effectuates program goals or agency priorities, and 200.340(b) requires the terms to specify it. Reading the termination clause is part of accepting an award, not of closing one.
Recipient and pass-through at once
2 CFR 200.332 makes a pass-through entity responsible for subrecipient fraud risk evaluation, ongoing monitoring, and resolution of audit findings tied to the subaward. Organisations that regrant routinely staff the grantmaking and leave the monitoring undefined.
Good standing is read by machine
California Government Code 12599.9(d)(2) lets a fundraising platform establish good standing from published IRS, Franchise Tax Board, and Attorney General lists. One lapse propagates to every platform at once, with nobody to argue with.
A certification made by accepting funds
Under 2 CFR 200.216(e), accepting a loan or grant certifies compliance with the Section 889 prohibition on covered telecommunications and video surveillance equipment. Donated cameras and conferencing hardware are the usual way that certification quietly becomes untrue.
How Thalorin helps
Donor data protection
Hold donor records separately from programme and grant data, and keep them out of the single audit reporting package that 2 CFR 200.512(a)(2) requires auditee and auditor alike to clear of protected personally identifiable information.
Grant compliance automation
Carry each award's terms against that award, with records held for the three years from submission of the final financial report that 2 CFR 200.334 requires, extended while a claim or audit remains open.
Funder security requirements
Map an institutional funder's security schedule onto control state already held, so a due diligence questionnaire is answered from evidence rather than rewritten from scratch for each foundation that asks.
Volunteer data management
Give volunteers scoped, time-bounded access that expires with the assignment, and keep the record of who could reach which programme data after the person has gone.
Program data security
Evidence the reasonable cybersecurity and other measures 2 CFR 200.303(e) requires for protected personally identifiable information and for anything the federal agency or pass-through entity designates as sensitive.
Cost-effective compliance
Elect and document the de minimis indirect cost rate of up to 15 percent of modified total direct costs under 2 CFR 200.414(f), and size the audit programme to the 200.501 threshold instead of above it.
Nonprofits: common questions
Can a federal agency terminate our grant because its priorities changed?
Where the award says so, yes. 2 CFR 200.340(a)(4) permits termination pursuant to the terms and conditions of the award, including, to the extent authorised by law, where the award no longer effectuates program goals or agency priorities, and 200.340(b) requires those provisions to be specified clearly and unambiguously in the terms. Executive Order 14332 of 7 August 2025 directs OMB to revise the Uniform Guidance so that discretionary grants permit termination for convenience. Read the termination clause before accepting, because it differs by agency.
When does a nonprofit need a single audit?
When it expends $1,000,000 or more in federal awards during its fiscal year, under 2 CFR 200.501(a). That figure rose from $750,000 in OMB's 2024 revision of the Uniform Guidance. Below the threshold the organisation is exempt from federal audit requirements for that year, though records must stay available to the agency, the pass-through entity, and GAO. The reporting package is due within 30 calendar days of receiving the auditor's report or nine months after the end of the audit period, whichever is earlier.
Does the Uniform Guidance require cybersecurity controls?
Yes, and in as many words. 2 CFR 200.303(e) requires recipients and subrecipients to take reasonable cybersecurity and other measures to safeguard information, including protected personally identifiable information, information the federal agency or pass-through entity designates as sensitive, and information the organisation itself considers sensitive. It sits inside the internal control standard rather than in a security section of its own, which is why it is so often missed. It names no framework, so the choice — and the defence of it — belongs to the organisation.
What is the de minimis indirect cost rate now?
Up to 15 percent of modified total direct costs under 2 CFR 200.414(f), available to recipients and subrecipients with no current federally negotiated rate, provisional included. The organisation sets the rate up to that limit, and no agency or pass-through entity may require a lower one unless a federal statute or regulation demands it. No documentation is needed to justify its use, and once elected it applies to all federal awards until the organisation negotiates a rate. Executive Order 14332 directs OMB to revise the Uniform Guidance to limit facilities and administration costs.
Why would our organisation disappear from a fundraising platform?
Usually because a list said it should. California Government Code 12599.9(d)(2) allows a charitable fundraising platform to establish good standing from machine-readable lists published by the IRS, the Franchise Tax Board, and the California Attorney General's Registry of Charities and Fundraisers, and 12599.9(a)(3) defines good standing as exempt status not revoked and no prohibition on soliciting in the state. Under 26 U.S.C. 6033(j)(1)(B), three consecutive years without an annual return or notice revokes exemption automatically, on the due date of the third.
Regulatory state described as of August 2026. Requirements change; verify against the current rule before relying on any date above.
Talk to us about Nonprofits.
See how one evidence artifact satisfies Nonprofits requirements alongside every other framework you carry.