Last April, the treasurer of a 90-member cultural association in Maryland got an email from a member threatening to file a complaint. The member had tried to cancel her recurring dues online and couldn’t find a way to do it. She’d signed up through the organization’s website, but cancellation required calling the treasurer’s personal cell phone during business hours. The treasurer had no idea this was a problem. Nobody on the board had heard of Maryland’s new data privacy law, or the state auto-renewal requirements that now applied to their membership dues.
She isn’t alone. The regulatory ground shifted under small nonprofits and community organizations throughout 2025, and more changes landed in January 2026. Most of them got zero attention from the volunteer-run groups they affect most.
Here are the compliance changes that matter for small membership organizations right now: what’s new, what’s changed, and what to do about each one. If you’re a volunteer treasurer, a board president in your first year, or someone who got handed the compliance binder at the last annual meeting, this is for you.
Disclaimer: This post is educational, not legal advice. Compliance rules vary by state, organization type, and specific circumstances. Talk to an attorney or CPA before making decisions that affect your organization’s legal status. The information here is current as of September 2026 but regulations change, and you should verify anything that applies to your group.
The Corporate Transparency Act: What Actually Happened
If you spent part of 2024 panicking about beneficial ownership reporting, you can exhale.
The Corporate Transparency Act (CTA) originally required most U.S. entities, including many small nonprofits, to report their beneficial owners to the Financial Crimes Enforcement Network (FinCEN). The deadline kept shifting as courts challenged the law’s constitutionality. Then, on March 21, 2025, FinCEN issued an interim final rule that changed everything: all entities created in the United States are now exempt from beneficial ownership reporting.
That means your community association, your cultural club, your neighborhood group, your sports league: if you’re incorporated or organized under U.S. law, you don’t need to file a beneficial ownership report with FinCEN. Tax-exempt nonprofits were already among the 23 exempt categories under the original CTA rules, but the new interim rule expanded the exemption to cover all domestic entities, including small groups that never filed for formal tax-exempt status.
What to do: Nothing, unless your organization was formed under foreign law. Take it off the board meeting agenda.
Auto-Renewal and Click-to-Cancel: The Rules That Hit Membership Dues
If you collect recurring membership dues, pay attention.
The Federal Rule (or Lack of One)
The FTC finalized its “click-to-cancel” rule in October 2024, requiring businesses to make cancellation as easy as signup. Then, on July 8, 2025, the Eighth Circuit Court of Appeals vacated the entire rule on procedural grounds. So there’s no federal click-to-cancel rule in force right now.
But that doesn’t mean you’re off the hook. On January 30, 2026, the FTC submitted a draft Advance Notice of Proposed Rulemaking to the Office of Management and Budget, restarting the process. The direction is clear: the federal government wants easy cancellation for recurring charges. And state laws are already filling the gap.
State Laws Are Already Here
While the federal rule got tied up in court, states moved forward on their own. These are the ones that matter most for membership organizations collecting recurring dues.
California (effective July 1, 2025): If a member signs up for recurring dues online, you must let them cancel online too. California’s amended Automatic Renewal Law requires a “prominently located direct link or button” for cancellation. You also need to send annual reminder notices to auto-renewing members and keep records of each member’s consent for at least three years.
New York (effective November 5, 2025): Requires advance notice of any material changes to renewal terms, including price increases. If you raise dues for auto-renewing members, you must either get their explicit consent before charging the new rate or let them cancel for a prorated refund.
Colorado (effective February 16, 2026): Requires a one-step online cancellation link for anyone who enrolled online. Colorado also expanded the definition of “consumer” to include business-to-business subscriptions.
Delaware, Illinois, Oregon, Virginia, and over a dozen other states have their own auto-renewal requirements with varying levels of strictness.
What This Means for Your Organization
If your community group collects membership dues on a recurring basis through a website or online signup, these laws apply to you. Not “might apply.” Do apply. A 100-member cultural association with annual auto-renewing dues is running a recurring subscription, and state attorneys general don’t carve out exceptions for volunteer-run groups.
The New York AG’s office proved this isn’t theoretical: in June 2025, they settled a $600,000 enforcement action against Equinox for making cancellation too difficult.
What to do:
- If members can sign up for recurring dues online, make sure they can cancel online too. A visible “Cancel Membership” button or link in their account, or a dedicated cancellation email address, both work.
- Before the first recurring charge, get clear written consent to the renewal terms: how often they’ll be charged, how much, and how to cancel.
- Send an annual reminder to auto-renewing members with the renewal amount and cancellation instructions.
- If you raise dues, notify auto-renewing members before the new rate kicks in.
- Review your refund and cancellation process to make sure it meets the requirements of every state where your members live.
IRS Filing: What’s Changed and What Hasn’t
The core IRS filing requirements for tax-exempt organizations haven’t changed. Your organization still needs to file annually: Form 990-N (the e-Postcard) for groups with gross receipts under $50,000, Form 990-EZ for groups under $200,000, or the full Form 990 for larger organizations. Miss three consecutive years and the IRS automatically revokes your tax-exempt status. Our tax basics guide covers the fundamentals.
What has changed:
Mandatory electronic filing. Starting with tax year 2025 (filed in 2026), the IRS requires electronic filing for all 990-series returns. Paper submissions are no longer accepted for most exempt organizations. If your treasurer has been mailing in the 990-EZ, that’s over. The e-Postcard was already online-only, so if you’re a small group filing the 990-N, this doesn’t change anything.
Late filing penalties. The penalty for filing a 990 or 990-EZ late is $20 per day, up to the lesser of $12,000 or 5% of the organization’s gross receipts. There’s no penalty for a late e-Postcard specifically, but the three-year revocation clock keeps ticking regardless.
Group exemption changes. The IRS ended its nearly six-year freeze on group exemptions and issued Revenue Procedure 2026-8, which establishes new requirements for organizations operating under a central umbrella. If your group is part of a national federation or association and files under a group exemption, the parent organization should be communicating what this means for local chapters. If they haven’t, ask.
What to do: Make sure your filing is on the annual plan. Put the deadline on the calendar: it’s the 15th day of the 5th month after your fiscal year ends. For calendar-year organizations, that’s May 15. If you need more time, file Form 8868 for a six-month extension. And document the filing responsibility clearly during leadership transitions so it doesn’t fall through the cracks when the treasurer changes.
State Data Privacy Laws: The Patchwork That Caught Nonprofits Off Guard
Data privacy is changing fastest and getting the least attention.
As of 2026, at least 20 states have enacted consumer data privacy laws. Many of them exempt nonprofits. Some don’t. And the ones that don’t are catching community organizations by surprise.
States where nonprofits are NOT exempt from data privacy requirements:
- Colorado (in effect since July 2023)
- Delaware (in effect since January 2025)
- Maryland (effective October 1, 2025, under the Maryland Online Data Privacy Act)
- Minnesota (effective July 31, 2025, under the Minnesota Consumer Data Protection Act; nonprofit compliance delayed until July 31, 2029)
- New Jersey (effective January 15, 2025)
- Oregon (in effect since July 2024 for businesses; nonprofits covered since July 2025)
States that broadly exempt nonprofits (but took effect in 2026):
- Kentucky (effective January 1, 2026): Nonprofits are broadly exempt.
- Rhode Island (effective January 1, 2026): Nonprofits are broadly exempt.
- Indiana (effective January 1, 2026): Nonprofits are broadly exempt.
These three states passed new data privacy laws that don’t apply to most community organizations. They’re listed here because you’ll see them in news coverage and need to know they don’t create new obligations for your group.
If your organization operates in a state that doesn’t exempt nonprofits, and you collect personal information like names, emails, phone numbers, or payment details, the law may require you to disclose what data you collect and why, give members the right to access or delete their data, and maintain reasonable data security practices.
For a 100-member community club, this means a basic privacy notice on your website and a process for handling member data requests. You don’t need a team of lawyers. You need a paragraph and a plan.
What to do:
- Check whether your state’s privacy law exempts nonprofits. If it doesn’t, the law applies to you. Pay attention to delayed compliance dates for nonprofits, as some states phase in requirements over several years.
- Write a simple privacy notice explaining what member data you collect, why, and how members can contact you about it.
- Make sure you have a way to delete or update a member’s data if they ask.
- Don’t collect data you don’t need. If you don’t need a member’s home address, don’t ask for it.
- Use tools with reasonable security. Storing member data in an unprotected shared Google Sheet isn’t meeting the “reasonable security” standard.
Employment Law Changes for Organizations with Paid Staff
If your organization is entirely volunteer-run, skip this section. If you have even one paid employee or part-time coordinator, keep reading.
Minimum wage increases. At least 19 states raised their minimum wages on January 1, 2026. Arizona, Colorado, Hawaii, Maine, Missouri, and Nebraska all hit or passed $15 per hour for the first time.
Overtime thresholds. The DOL attempted to raise the federal salary threshold for overtime exemption to $58,656 per year, but a federal court struck down the rule in November 2024. The threshold remains at $35,568 per year ($684 per week). If your organization pays a salaried employee less than this amount, they’re entitled to overtime pay for hours worked over 40 in a week, regardless of their job title. Note that some states set higher thresholds, so check your state’s rules too. This catches small nonprofits that pay a part-time “executive director” a modest salary and assume the title makes them exempt from overtime.
Paid leave expansions. California, Massachusetts, Michigan, Minnesota, and Washington all expanded their paid sick leave requirements in 2025.
What to do: Review your state’s current minimum wage rate, check whether any salaried employees fall below the federal overtime threshold ($35,568/year) or your state’s threshold, and verify your leave policies are current. If your organization is considering hiring its first employee, factor these costs into the budget before making the offer.
State Registration and Annual Reports: The Quiet Compliance Trap
Your federal tax filing is only one piece. Most states require incorporated nonprofits to file annual reports with the Secretary of State and, separately, to maintain charitable solicitation registration if you ask for donations.
Several states overhauled their filing systems in 2025, migrating to new online portals. The problem: some organizations that were in good standing under the old system are now flagged as “expired” or “delinquent” in the new one because they didn’t re-register in the updated portal. According to Cogency Global, states are expanding their annual report requirements beyond simple “good standing” checks to include new required data fields, faster update duties, and electronic contact requirements.
If your organization’s state filing status lapses, you can lose your legal existence at the state level even while your IRS tax-exempt status remains active. That means you can’t open bank accounts, sign contracts, or rent venues as a legal entity.
What to do:
- Check your organization’s status with your state’s Secretary of State. Most have an online search tool.
- If your state migrated to a new filing system, make sure your organization is registered in the new portal.
- Put state filing deadlines on the calendar alongside your federal return.
- If your organization solicits donations (including at fundraising events), check whether your state requires charitable solicitation registration. About 40 states have some form of this requirement.
- Include both federal and state compliance deadlines in your annual report and review them at a board meeting each year. Our complete guide to running a volunteer organization covers how to build these systems.
Insurance: What’s Worth Carrying in 2026
Small organizations consistently underestimate insurance. Two types of coverage deserve attention.
Directors and Officers (D&O) insurance protects board members from personal liability for decisions made in their official capacity. The federal Volunteer Protection Act provides some protection, but it doesn’t cover everything. Board members who receive any compensation (even a small stipend), officers who sign contracts, and treasurers who handle money are all exposed to personal liability if something goes wrong. D&O insurance typically costs $500 to $2,000 per year for small nonprofits. If your board members knew the personal exposure they carried without it, half of them would resign tomorrow.
General liability insurance covers injuries, property damage, and related claims. Many venues won’t rent to you without a certificate of insurance. A basic policy with $1 million per occurrence typically runs $400 to $1,200 annually for small nonprofits.
What to do: If you don’t have D&O and general liability insurance, get quotes. Mention both at your next board meeting. Work the premiums into your annual budget. If you have employees, add workers’ compensation, as it’s required by law in almost every state.
A 2026 Compliance Checklist for Small Organizations
You don’t need to hire a compliance officer. You need one person on the board willing to spend a Saturday afternoon going through this list once a year.
Federal
- File your IRS annual return (990-N, 990-EZ, or 990) before the deadline
- Verify your tax-exempt status is active at IRS Tax Exempt Organization Search
- Confirm you’re filing electronically (paper filing is no longer accepted for most returns)
State
- File your state annual report with the Secretary of State
- Renew charitable solicitation registration if required
- Check whether your state’s data privacy law applies to your organization
Recurring Dues and Auto-Renewal
- Confirm members can cancel recurring dues as easily as they signed up
- Get clear written consent before the first recurring charge
- Send annual renewal reminders with terms and cancellation instructions
- Review your cancellation and refund process
Insurance and Governance
- Verify D&O and general liability insurance are current
- Bylaws are up to date and accessible
- Financial records are organized and backed up
- Compliance responsibilities are documented for incoming board members
The Common Thread: Write It Down, Hand It Off
The pattern behind most compliance failures at small organizations isn’t ignorance. It’s turnover. The treasurer who knew the e-Postcard was due in May didn’t tell the new treasurer. The president who set up the state registration retired and nobody picked it up. The person who understood the auto-renewal rules left the board and the knowledge left with them.
Every compliance task on this list should be documented in a way that survives a leadership transition. Write down what needs to be filed, when, where, and by whom. Store those instructions where the next person can find them.
The rules aren’t going to get simpler. States will keep passing new privacy laws. Auto-renewal requirements will keep tightening. The IRS will keep revoking organizations that forget to file a ten-minute form. The best protection isn’t a lawyer on retainer. It’s a board that knows what’s required and a system that doesn’t depend on any single volunteer’s memory.
Keeping your organization compliant is easier when your member records, dues, and communications are organized in one place. Somiti handles recurring dues with built-in cancellation options, tracks every payment, and keeps your records ready for tax time. Start free and take one thing off the compliance list.