Nonprofit User Manual: What are our Actual Legal Requirements?
How many of your habits, bylaws, and processes do you think are, by law or regulation, required? I bet you think it’s a much higher percentage than it actually is. I know I did for a long time.
So many of us in the nonprofit sector conflate habit with requirement because we drag our habits around with us from one organization to the next. We figure, “it’s just always been done that way, so that’s the way it must have to be done.” Add to that our tendency to wholesale adopt “best practice” lists and recommendations when not all of it applies to us. All of this holds us back from running our organizations in the way that makes the most sense for our unique combination of: location, budget, team makeup, mission, resources, etc. We’ll go into best practices in later articles, breaking it up by topic. Today, we’re looking at what is legally required, so that we all understand the basic foundation.
So, with the big caveat that I am not a lawyer, let’s go way back to basics and look at some of our most commonly assumed “musts”. And, heads up, a lot of this going to be unsatisfactorily vague.
What is a nonprofit?
Broadly, a nonprofit, as defined by the IRS, is any organization in which “no part of the organization’s net earnings can inure to the benefit of any private shareholder or individual”. Contrary to common belief (or the name itself), a nonprofit can earn a profit in any given year, but those net gains must be used in accordance with the mission of the nonprofit and overseen by its Board, following IRS guidelines. Nonprofits do not automatically have federal tax-exempt status. To receive tax-exempt status by the IRS, the org needs to comply with the IRS definition of a nonprofit, align with one of the recognized nonprofit categories, and apply for tax-exempt status.
The IRS has over 30 categories for tax-exempt organizations, all of which must qualify as non-profits sharing the one criterion quoted above. Most of us are familiar with 501c(3) nonprofits – these are generally charitable, religious, scientific, educational, and other such organizations, but not all organizations that perform such work qualify as a 501c(3).
Shades of grey in nonprofit/tax-exempt status
Only nonprofits can be granted tax-exempt status by the IRS, but not all nonprofits have that exemption. There are many startup and small nonprofits that do not yet have their official tax exempt status or never plan to get it; and they can be in any stage of the process, from a loosely-formed neighborhood group of volunteers that is informally collecting donations for a project and not setting up an official organization, to a cohesive organization being fiscally-sponsored by a bigger tax-exempt organization while they await their tax-exempt determination.
We won’t go into the details of how to start a nonprofit today (and that’s not a specialty of Van Waes Consulting anyway). But, briefly, nonprofits get started at the state level. The nonprofit is Incorporated at the state level, and the state then decides about state tax exemption. Generally, if the nonprofit wants to, for example, open a bank account, they need an EIN (Employer Identification Number; like an organization’s SSN) from the federal IRS. The org must be incorporated in a state already to request an EIN, and they can do it with or without also applying for federal tax-exempt status. Any entity with an EIN is, by default, considered taxable by the IRS until that entity applies for and receives tax-exempt status — put another way, a nonprofit with an EIN must still pay taxes on its income if it has not yet received tax-exempt status or if it is not fiscally sponsored by another org that does have tax-exempt status.
TL;DR: If you’ve got an EIN, you must file a federal tax return. And, if you’re a nonprofit with an EIN that doesn’t have a fiscal sponsor or a tax-exempt determination from the IRS, you will be taxed on your income. Also, if you’ve incorporated in a state, with or without having an EIN, you must file a state tax return.
All of the below assumes that you have your tax-exempt determination from the IRS.
Who is checking to make sure we’re following the law and regulations?
At the Federal Level
At the federal level, because the IRS holds the power of granting federal tax-exempt status to nonprofits, it is the primary arbiter in determining whether a nonprofit is following applicable laws and regulations when it comes to governance and finance. It also metes out the punitive measures for violations.
Additionally, because 501c(3)s hold the unique distinction among nonprofits of any donations to them being considered tax-deductible, this type of nonprofit usually receives the most scrutiny from the IRS. Because they generate the most revenue and because IRS staffing is limited, the biggest 501c3s are usually scrutinized the most. However, any nonprofit that has been granted tax-exempt status is eligible for closer inspection. And any Administration can decide, for political reasons or otherwise, to closely examine some nonprofits more than others, no matter the size or type. Therefore, if you’re a small nonprofit, while the odds are in your favor that the IRS is unlikely to give you anything other than a cursory glance, you shouldn’t rely on that “immunity” — always act as if you could be under the microscope at any point.
The IRS uses the documents you filed when you were given tax-exempt status (Bylaws, Articles of Incorporation, Mission Statement, etc.), your annual 990s and other relevant IRS forms, and (where relevant, see below) your audits to determine whether you are following the rules.
At the State Level
States also monitor the charities incorporated and registered in their state and, sometimes, even those that should be registered there and haven’t (see below). States use the same documents the IRS does to monitor whether nonprofits are following state rules (whether tax-exempt at the federal level or not). State laws and regulations, as you’ll see throughout this article, are usually more specific and detailed than the federal laws.
Registration
When your organization was founded, it was “incorporated” in a specific state — your Articles of Incorporation officially declared your existence as a nonprofit organization — first to the state, then to the federal government when you applied for your EIN and tax-exempt status. Your organization must also be “registered” as a charity in at least one state (see below). While your incorporation was a one-time, fixed point, your registration usually must be renewed annually (a bit like buying your car versus renewing its liscence plates). There are more shades of grey here than are at first obvious, so here are some examples scenarios:
The org was originally incorporated in State A — it needs to be registered as a charity in State A.
The org was incorporated in State A but moved its headquarters to State B — It needs to be registered as a charity in State B AND (by law or by safe practice) have a registered agent in State A; and, under most state laws, it very likely still needs to be registered in State A as well.
The org was incorporated in State A but now operates entirely virtually, with no physical headquarters — it needs to remain registered in State A, and (by law or by safe practice) have a registered agent in State A.
The org is operating entirely virtually from the start — the Board needs to choose in which state it will incorporate, file Articles of Incorporation, register in that chosen State, and (by law or by safe practice) have a registered agent in that state.
The org is incorporated in State A (and headquartered there or operating virtually), but it solicits donations online, via social media, or by mail from all over the country or from nearby states — This gets tricky because different states have different regulations and laws, and the laws can be fuzzy, so, to be safe — the org must be registered in State A — AND — it would be wise to be registered in every other state to which the org directs fundraising solicitations directly aimed at the residents AND in every other state from whose residents the org receives repeated or significant donations. (Clear as mud?) There are sometimes exemptions to having to register in other states — usually for religious orgs, hospitals, education institutions, and very small nonprofits — check with a lawyer before you assume you’re exempt. Registering in many states gets expensive and time-consuming, so if you really want to nail down where it’s legally required, again, you’ll need to talk to a lawyer.
Do we need an audit (legally)?
The IRS does not require an audit, no matter your budget size, unless you use $750k or more in federal funds in a single fiscal year (note that this $$ cut-off can change from year-to-year). However, (as of Feb. 2026) 29 states do legally require a professional audit or financial review, depending on budget size — sometimes they require that a CPA perform the audit/review, sometimes just a qualified 3rd party. Like the IRS, of the 21 states (+ DC) that do not require an audit, they sometimes do if you reach a certain threshold of using state funding. You also might have donors and other funders that require an audit as part of your contract with them, so not getting one could put you in legal breach of contract (in addition, obviously, to jeopardizing your funding).
Even in cases where an audit or financial review is not legally required, it is generally a good idea to get one so that you and your donors can rest assured that everything is on the up-and-up. This will also help set you up for clear, clean accounting as you grow and potentially do become legally required to get an audit/review. Charity rating organizations that donors use to do background checks on orgs to whom they might want to donate also use the presence of regular, timely, clean audits as a major part of the nonprofit’s score in their system. Consider getting a financial review every 3-4 years for nonprofits under $300k, every 1-2 years for $300 - 500k, and every year for $500k - 850k. For $850k and up, consider getting a full audit every year.
Many accounting firms that perform nonprofit audits/reviews will provide discounted rates during their off seasons. Make sure they are indeed experienced in nonprofit auditing, and then file an extension with the IRS if you need to in order to get the off season rate (it’s easy to do and almost always granted).
Board Governance
Board Size
There is no IRS requirement concerning board size. However, the IRS considers it best practice for any tax-exempt organization to have at least three non-related board members. Therefore, having fewer board members or members who are all related might open you up to more scrutiny. Additionally, state laws may be more specific about board size requirements.
Board Term Limits
No federal or state laws, in practice, prohibit how long a board member can serve. Some states do require some specific language in your Bylaws concerning term limits, number of terms, and how that gets decided by the board; but none of the laws necessarily prohibit a board member serving for as long as the board wants them to, in accordance with the org’s Bylaws. However, there are a number of best practice considerations that we can cover in another article.
Executive as a Board Member
No federal or state law prohibits the executive from also being a voting member of the Board — they leave it up to what is indicated in your Bylaws and Articles of Incorporation. California stipulates that if the Bylaws read that the executive is an ex officio member of the board, then the executive cannot be counted or documented as a board member (this comes into play when meeting the CA minimum board member requirement). Best practice, on the other hand, tells us that setting up the executive as a voting member of the board can be problematic in a number of circumstances — we can cover that in a later article.
Paying the Board
Technically, it is not always illegal for a tax-exempt organization to pay a board member — but they cannot be paid for their board service — it has to be for something else (see below). In any case, paying a board member can open up the nonprofit and the individual board member to targeted scrutiny by the IRS and potentially expose the board member to excise taxes. This is because, remember the ONE rule that the IRS uses to define a nonprofit?: “no part of the organization’s net earnings can inure to the benefit of any private shareholder or individual”. It is very difficult to prove that payment to a board member was not “to their benefit”. In general, most funders also frown upon or prohibit paying board members — partly for the legal reasons and partly for best practice in governance (which we can get into in another article — today we’re talking about legal requirements).
Note that it is totally fine to reimburse board members for travel expenses directly related to their board work (e.g., attending a board meeting). However, even that can get scrutiny from funders and the IRS if the board meetings are lavish, expensive, in exotic locations, etc. — i.e., if it’s clearly a boondoggle for the board. It is also totally fine — and very common — to decide that you do not want to use your budget that way and to require board members to pay their own way.
Paying a board member doesn’t always look like handing over a direct deposit. Using an example I have come across . . . . a small nonprofit was renting its office space in a building owned by a board member. That was a violation of the IRS ban on “private inurement” to board members because there were other office spaces that were available (and were even cheaper). Had it been a rural nonprofit and the one available space happened to be owned by a board member, the IRS might not see it as a violation — but the board would still need to vote, on record, about procuring that space and prove that it was the only one available, and the owner of the space would need to recuse themselves from the vote.
What if there are few or no staff?
Some board members of nonprofits with few to no staff might find themselves spending a great deal of time on their board work, needing to do a lot of admin, planning, and other work that might be done by staff at a larger organization. Those board members still must not be paid for board service, however intensive it may be.
At the same time, some board members at such organizations might also be essentially filling specific “staff” roles in addition to their board work. In such cases, the nonprofit may pay those board members for their non-board, “staff” work — on an individual basis, for well-defined roles. To support the case that any such pay is not in violation of “private inurement,” the IRS may check that:
each, individual board member (or trustee) being paid is providing a critically-needed, skill-specific service that only they can provide;
that service is not part of their governance, fiduciary, and oversight duties as a board member (i.e., it’s more like a staff or contractor role with a clear job description); and the service is documented, by task, on a time sheet;
that individual has no part in determining their pay (they’ve recused themselves from such discussions and votes);
the individual is being paid a demonstrably fair market rate given comparable organizations.
Even following all of those rules, however, doesn’t always protect you. Definitely avoid blanket paying the whole board the same amount — that will signal that you are paying board members for their board service, which is not allowed.
What happens if there’s a “private inurement” violation?
Violations of “private inurement” result in steep excise taxes (fines) for the board members who were paid and for every board member or staff member who knew about the payment and had the authority to authorize payment or knew about the payment and had the authority to stop payment (but didn’t). Those excise taxes aren’t levied on the nonprofit — they’re levied on the individuals, and must be paid by the individuals, personally, not by the nonprofit. Note also that later resigning from the board or staff does not provide any protection. There is a one way statute of limitations. If the organization dutifully reports all payments to board members on its 990, even ones that would be considered a violation, and the IRS does not catch the violations, then, after six years, the excise tax cannot be levied on anyone. But if the organization fails to report all payments to board members or fails to provide the backup documentation to justify the payments, then there is no time limit on when the IRS can levy the excise taxes on the individuals, even decades later, even after they’ve long left the board or staff.
A few caveats
All of that said, there are sectors and types of nonprofits where in Board members regularly, and legally, receive fees-for-service or stipends. The reasons vary per sector, but they boil down to it being easily justifiable, even in alignment with the IRS “no private inurement” rule. Examples might include: large hospital systems, large colleges and universities, credit unions, mutual insurance companies, trade & professional associations, and housing and utility cooperatives. Even if your organization falls into one of these categories, definitely speak with a lawyer before setting up any kind of payments to board members.
What must be in our Bylaws and Articles of Incorporation?
The IRS is not very prescriptive here. In order to receive your tax-exempt status, your Articles of Incorporation must clearly show the purpose (mission) of your organization, that that is its only purpose, and that it aligns with the definition of whatever tax-exempt classification you’re seeking (e.g., 501c3). As far as the IRS is concerned, your Bylaws simply must not be in violation of the requirements of your tax-exempt designation, pretty much limited to:
if you applied for status as a religious org, e.g., your bylaws don’t seem to be for an HOA — i.e., your bylaws align with the type of org you applied to be;
no private inurement (see above);
no political activity (if a 501c3);
assets are permanently dedicated to the mission, and, if the org is dissolved, assets will be distributed and debts resolved in the manner the federal IRS and the state require of your tax-exempt classification;
there is a board of directors (or trustees) with governing authority.
All states require that you have Bylaws and Articles of Incorporation, but none have an exhaustive checklist of what must be in the Bylaws. Some states do have a few prescriptive requirements for Bylaws concerning:
number of directors
term length
election and removal procedures for board members
classes, voting rights, and notice and quorum rules for organizations with members
board officer titles, duties, and appointment/election process
Additionally, before you add anything concerning board management and oversight of the executive or stipulations concerning the executive’s employment (how they are hired, fired, evaluated, and paid; what benefits they receive; etc.), make sure that none of it is in violation of employment law in the state(s) where the executive lives (definitely) and where the organization was incorporated (to be safe).
All of that said, the absence of a prescriptive rule doesn’t mean that your Bylaws should only cover the bare minimum. You want your Bylaws to protect the Board members, the executive, and, where relevant, the members; and set rules, procedures, boundaries, and runways that allow for clear governance and roles. So you’ll want to be clear about all the basic governance functioning of the organization.
Your state’s nonprofit association will likely have templates for both documents that align with federal and state laws. You’re free to tweak those and add to them as makes sense for your organization — as long as none of your changes violate one of the few, vague federal and/or (maybe more numerous or specific) state requirements.
Best practice in what to have in your Bylaws is another topic that we can get into in another article — and it varies by organization mission, operational type, location, size, etc. But I encourage you to use the IRS’s lack of prescriptiveness to take a fresh look at your Bylaws every 5 years and see what needs refreshing, tweaking, deleting, or adding.
Also remember that all states require that any amendments to the Bylaws be voted on by a quorum of the Board. In some states, amendment by membership vote is also allowed.
Board Conduct
Legally, according to the IRS, the Board and its members must adhere to their three main duties (which are sometimes laid out in more detail in state laws and regulations):
Duty of Care: Each board member has a legal responsibility to participate actively in making decisions on behalf of the organization and to exercise their best judgment while doing so.
Usually, a board member or board as a whole would only run into legal issues here in cases of “gross negligence” or “reckless disregard”. But lax standards and enforcement of the Duty of Care (even if not crossing a legal boundary) set up a slippery slope and may not be looked upon favorably by donors and funders.
Duty of Loyalty: Each board member must put the interests of the organization before their personal and professional interests when acting on behalf of the organization in a decision-making capacity. The organization’s needs come first.
This is where “private inurement” (or “self-dealing”) comes into play — see above. It should also be noted here that a board member airing inside “dirty laundry” to others or otherwise representing the organization in a negative light outside the board room could lead to civil penalties.
Duty of Obedience: Board members bear the legal responsibility of ensuring that the organization complies with the applicable federal, state, and local laws and adheres to its mission.
Violations can trigger consequences for individual board members and/or the organization as a whole depending on the state laws and the nature and severerity of the violation. Possible consequences could include
Some violations in some states could also trigger loss of professional licensing of the relevant individual(s).
In general, it’s a good idea to make sure that you have Directors and Officers insurance to provide some cover. And, of course, remind the board regularly of these three legal duties — don’t let conflict avoidance make you lax in following these duties and ensuring that board habits and Bylaws enforce them.
501c3s and Political Activities
By the statutes surrounding 501c3 classification, these organizations cannot engage in “substantial” political activity. If that feels vague, it’s because it is. Political activities include lobbying Congress and taking stances on anything that is up for a vote — particular candidates or particular ballot items. However, a 501c(3) can take a stance on issues that directly align with its mission, and they can even “lobby” Congress on these issues if kept well under the “substantial” limit ("lobby" = educating Congress on topics relevant to the mission, not registered lobbyist work).
It’s easier to understand this with some examples of what is allowed for a hypothetical conservation-focused 501c3:
They can urge their supporters to write to Congress in support of a bill that advances public lands conservation — it’s relevant to their mission and is not up for public vote, only Congressional vote.
They can send staff to educate members — of all political parties (to keep it as nonpartisan as possible) — about the issue (as long as the time is logged and the time and money spent on it are less than around 10% of total staff time and total expense budget).
They can create a blank scorecard for their supporters to use to score their relevant Congressional and local political candidates on issues relevant to conservation. The organization can educate supporters on conservation issues relevant to upcoming elections, show them how to find how their candidates have voted on these issues in past, show them how to find townhalls with the candidates, etc.
What could this hypothetical organization AND its staff and board not do?
They cannot suggest to their supporters which candidate to vote for or how to vote on a specific ballot item that is up for public vote.
They cannot otherwise back a candidate or ballot item.
They cannot publicly or when acting as a representative of the organization take a stance on a politcal party, candidate, or ballot item.
They cannot do any of the examples on the allowed list if the issue in question is not demonstrably, obviously part of their mission (see also Mission Creep below).
Mission Creep
When you applied for your tax-exempt status, you told the IRS what your mission was and how’d you meet your mission, which they then used as part of the information they needed to grant you your tax-exempt status and specific classification. And, since your organization’s income is tax exempt, the IRS is basically putting the public’s trust in you to stay aligned with your purpose, your mission.
That doesn’t mean that your mission has to stay word-for-word the same. It can be refined and adjusted over time to meet the current circumstances, but not in a way that would give the IRS pause to think that it may need to reconsider your organization as a different one from the one that was originally granted the tax-exempt status. Note that any amendments at all to the original Mission Statement should be voted upon by the Board and the motion and vote documented in board meeting minutes, even if it’s correcting a typo. This will help provide extra cover should the IRS question a change to the Mission Statement.
As part of the public trust, the IRS also expects your operations, your work, your communications, everything you do to “stay on mission” and to stay within activities that are allowed under your classification. For example, a religious organization cannot start operating (even partially) as a trade association. Or an animal shelter cannot start running a shelter for people experiencing homelessness.
Mission creep can crop up in a number of circumstances, including donors asking for work that is outside of mission, or board members getting excited about something that is outside of mission. You’ll need to watch out for this and rein it in, or consider a board vote to adjust the mission — and, again, we can talk about that more in a later article.
Sticking to your mission when the world is on fire
Another way that mission creep can crop up suddenly is in the well-meaning desire by board members, the executive, volunteers, and others to shift the organization’s voice and work to focus on the immediate needs of a crisis — for example, the 2025-2026 executions and kidnappings by ICE or the 2020 Black Lives Matter protests. Many nonprofits have wanted to shut down their normal work and focus instead on those crises — or they’ve wanted to donate some of their revenue to organizations and movements that are directly involved with the crises, even when it’s not directly tied to their mission. The nonprofit sector is especially vulnerable to this kind of mission creep, because we care, deeply, and because we’re problem-solvers, community-builders, and healers. It’s natural. It can also feel like a lot of pressure when the public is demanding that you switch focus or donate to the cause, all the while not understanding that you are not legally permitted to do so.
And maybe in the face of all these atrocities it can be hard to justify to yourself caring at all that the IRS might have a problem with you switching the organization’s focus. But, even putting the legal issues aside, your organization is set up to serve its mission. Your relationships, community trust, infrastructure, skill sets, networks, everything is set up for the mission you already have. That is where you are best placed to make a difference. Every person, brand sponsor, and grant-provider have invested in your mission as-is and want you to see it through. Your mission is making the world better, even if it’s not on the ground at the places experiencing the most public pain. Promoting the arts, teaching kids STEM, coaching soccer for queer kids . . . . whatever it is that you do is needed and is the antidote to the hate and destruction we’re being bombarded with. It is relevant. And it is a critical part of the fight.
So how can you address these social, political, and human and civil rights issues without mission creep? Talk about how they intersect with your mission. Get training for your staff, board, and volunteers in how to make sure that your work isn’t perpetuating the problems. Make sure you’re taking care of your employees and volunteers — e.g., don’t force them to work from the office if they live in a city overrun by ICE. Focus on your mission and make sure that the work you do to achieve it and the way in which you do the work are aligned with civil and human rights, human dignity, care for the environment, etc.
In Conclusion
It usually surprises folks how little of how we work and operate in the nonprofit sector is dictated by specific laws and regulations. It all boils down, basically, to — the organization should stick to its original mission, and no one should be profiting off its income. Like I said, I’m not a lawyer. It is always best, when in doubt, to seek legal advice from someone familiar with the nonprofit laws in your state. But I hope this helps answer some of the common questions that come up amongst nonprofit boards and executives.
Also, a final note: I’ve seen nonprofits get away with stuff on purpose (accidentally or inadvertently is a different story — I’ve never known a single nonprofit or private business that has all their sh8t together all the time). We all have. I’ve seen board members being paid big bucks just for showing up, caving to donor demands that stray beyond the mission, ridiculously lavish board meeting locations, . . . . Just because they appear to have gotten away with it as far as IRS oversight is concerned doesn’t mean that it all actually is legal, and it doesn’t mean that anyone else will get away with it. So just be careful who you use as role models.
