2 CFR Part 200 Compliance for Nonprofits Pursuing Federal Grants
A Practical Guide for Direct Recipients and Subrecipients of Federal Financial Assistance
Nonprofits occupy a unique position in the federal funding landscape. Some receive awards directly from federal agencies as prime recipients. Others receive funds through state agencies, local governments, or larger nonprofits as subrecipients. Many operate in both roles simultaneously, receiving a direct federal award while also accepting subgrants from a state-administered program.
The compliance obligations under 2 CFR Part 200 apply in both cases, but they look different depending on the role your organization holds under a specific award. Understanding which role you are in, and what that role requires of you, is the foundation of nonprofit federal compliance.
This section is written for executive directors, finance directors, development officers, and program managers at nonprofits of all sizes pursuing or managing federal financial assistance.
Direct Recipients and Subrecipients Face the Same Compliance Standards
Section 200.101 establishes that the requirements of Part 200 flow down through the entire subaward chain. When a federal agency awards a grant to a state agency, and that state agency passes funds to a nonprofit, the nonprofit is a subrecipient and subject to the same requirements that apply to the state agency as the prime recipient.
The pass-through entity, in this case the state agency, is responsible for ensuring the subrecipient is aware of applicable requirements and for including them in the subaward document. But awareness from the pass-through entity is not a substitute for the nonprofit's own compliance. Subrecipients are responsible for their own compliance with Part 200, and an audit finding against a subrecipient is the subrecipient's problem to resolve regardless of what the pass-through entity did or did not communicate.
Section 200.331 establishes how the distinction between a subrecipient and a contractor is made. This distinction matters because contractors on federal awards have different obligations than subrecipients. A subrecipient carries out a portion of the program, makes programmatic decisions, and is measured against the program's objectives. A contractor provides goods or services to the recipient and operates in a normal commercial capacity. Most nonprofit partners in federal programs are subrecipients, not contractors, and should be managed accordingly by both the pass-through entity and the nonprofit itself.
Financial Management Systems Must Be Capable of Award-Level Reporting
Section 200.302 requires every recipient and subrecipient to maintain a financial management system with documented capabilities specific to federal award management. The system must identify each federal award by Assistance Listings title and number, Federal Award Identification Number, fiscal year, and awarding agency. It must produce accurate financial reports for each individual award, maintain records that identify the amount, source, and purpose of all federal expenditures, and compare actual expenditures to approved budgets on an ongoing basis.
For a small nonprofit managing one or two federal awards, this often means configuring QuickBooks, Sage, or a similar small-organization accounting platform to track expenditures by award using project or class codes. The accounting system does not need to be sophisticated. It needs to be configured so that federal award expenditures can be separated from general operating expenditures and from each other, and so that reports can be produced on demand.
The requirement for written procedures is separate from the accounting system itself. Your organization must have documented procedures for determining whether a specific cost is allowable under a federal award. Those procedures must be in writing, must be current, and must reflect how your finance staff actually makes those determinations. An auditor asking for your written cost allowability procedures is not asking about institutional knowledge. The document must exist.
Internal Controls Must Be Documented and Functional
Section 200.303 requires recipients and subrecipients to establish, document, and maintain effective internal controls over each federal award. The standard references the Government Accountability Office's Green Book and the COSO framework as benchmarks, but the regulation does not require small nonprofits to implement the full framework designed for large government agencies. It requires reasonable controls proportional to the organization's size and risk profile.
For a small nonprofit, functional internal controls over federal awards typically include separating the authority to approve expenditures from the authority to process payments, conducting monthly reconciliation of federal award expenditures by an individual who did not process the transactions, maintaining documented authorization levels for purchasing decisions, conducting board or audit committee review of financial reports that include federal award expenditures, and protecting financial data and beneficiary information through basic cybersecurity measures.
Section 200.303(e) specifically requires reasonable cybersecurity measures to protect personally identifiable information and other sensitive data. If your organization maintains client records, case files, or any other data covered by state or federal privacy requirements in connection with a federal award, those records need documented protection measures. A cybersecurity incident does not by itself create a compliance violation. Operating without any documented protection measures for sensitive data does.
Allowable Costs and the Difference Between Direct and Indirect Costs
Section 200.403 establishes the criteria that every expenditure charged to a federal award must satisfy. A cost is allowable only when it is necessary and reasonable for the program, conforms to any limitations in Part 200 or the award terms, is consistent with policies applied uniformly to federally and non-federally funded activities, is treated consistently across cost categories, is determined in accordance with generally accepted accounting principles, has not been charged to another federal program in the current or prior period, and is adequately documented.
The consistency requirement is where many nonprofits create compliance problems without realizing it. If your organization treats the executive director's salary as a program cost when charging a portion to a federal award but as an administrative overhead cost in your general ledger for other purposes, that inconsistency is a compliance problem. The treatment of costs must be uniform regardless of which fund or program they are charged to.
Section 200.413 covers the distinction between direct costs and indirect costs. Direct costs are those that can be specifically identified with a particular federal award, such as staff time spent directly on program activities, supplies consumed in delivering the program, or travel to conduct site visits required by the award. Indirect costs, also called facilities and administration costs, are costs that benefit multiple programs and cannot be attributed to a single award without disproportionate effort.
Administrative and clerical staff salaries are generally indirect costs. They may be charged directly to a federal award only when the administrative services are integral to the specific award, the individual can be specifically identified with the award, and the costs are not also recovered through an indirect cost rate. The third condition is critical: charging a cost as both a direct cost and an indirect cost is double-charging and is expressly prohibited.
The De Minimis Indirect Cost Rate Is the Starting Point for Most Small Nonprofits
Most small nonprofits do not have a negotiated indirect cost rate with a federal cognizant agency. Section 200.414(f) allows any recipient or subrecipient without a current negotiated rate to elect a de minimis rate of up to 15 percent of Modified Total Direct Costs. The organization sets its own rate up to that ceiling. The de minimis rate requires no documentation to justify, can be used indefinitely, and once elected must be applied consistently across all federal awards.
Modified Total Direct Costs includes salaries, wages, fringe benefits, materials, supplies, services, and travel, and up to the first $50,000 of each subaward. It excludes equipment, capital expenditures, participant support costs, and the portion of each subaward exceeding $50,000.
Pass-through entities are not permitted to require a subrecipient to use a de minimis rate lower than the rate the subrecipient has elected or negotiated, unless required by federal statute or regulation. If a state agency or larger nonprofit pass-through entity is attempting to impose an indirect cost rate on your organization that is lower than your elected or negotiated rate, that is not compliant with Part 200 and should be addressed directly with the pass-through entity.
Procurement with Federal Funds Requires Competitive Procedures
Section 200.318 through Section 200.327 establish procurement standards that apply to all purchases made with federal award funds. These standards apply to subrecipients with the same force as they apply to prime recipients.
Purchases at or below the micro-purchase threshold (currently $10,000) may be made without competitive quotations when the price is considered reasonable and that conclusion is documented. Purchases above the micro-purchase threshold but below the simplified acquisition threshold ($250,000) require price quotations from an adequate number of qualified sources. Purchases above the simplified acquisition threshold require formal competitive procurement through either a sealed bidding process or a competitive proposal process with public notice.
Sole source purchases are permitted only when the amount does not exceed the micro-purchase threshold, only one source can fulfill the need, a genuine emergency does not permit competition, or the federal agency or pass-through entity approves a noncompetitive approach in writing. Past satisfaction with a vendor, a program officer's familiarity with a particular consultant, and the administrative inconvenience of running a competitive process are not permissible justifications.
All procurement procedures must be in writing. Conflicts of interest in the procurement process are prohibited: no person with a financial interest in a vendor under consideration may participate in the selection, award, or administration of a contract with that vendor.
Nonprofits That Pass Funds to Other Organizations Are Pass-Through Entities
When a nonprofit that receives a federal award passes funds to another organization through a subaward, the nonprofit takes on pass-through entity obligations under Section 200.332. This is common in nonprofit networks where a national or regional organization receives a federal award and distributes funds to local affiliates or partner organizations.
Before making any subaward, the nonprofit must verify the proposed subrecipient is not suspended or debarred in SAM.gov and must document that verification. Every subaward document must include the subrecipient's Unique Entity Identifier, the Federal Award Identification Number, the award date, the subaward period of performance, the amount obligated, the Assistance Listings number and title, and the applicable indirect cost rate.
During the performance period, the nonprofit must monitor the subrecipient's activities, review financial and performance reports, and ensure corrective action is taken on any adverse developments. The monitoring burden scales with the subrecipient's risk level. A high-risk subrecipient with no prior federal grant experience and no current audit will require more active monitoring than an established organization with a clean audit history.
Record Retention Is Three Years from the Date of Final Report Submission
Section 200.334 requires all records related to a federal award to be retained for three years from the date the final financial report is submitted. Financial records, supporting documentation, programmatic records, procurement files, and all other records pertaining to the award must be retained for the full period.
If an audit, litigation, or claim is initiated before the three-year period expires, records must be retained until the matter is fully resolved. For property and equipment purchased with federal funds, the retention clock runs from the date of final disposition of the asset. For indirect cost rate proposals, the clock runs from the date of submission to the federal agency or the end of the fiscal year covered, depending on whether the proposal was submitted for negotiation.
Records may be electronic when maintained under procedures that prevent alteration and ensure readability throughout the retention period.
The Single Audit Threshold Applies to Nonprofits the Same as Other Recipients
Section 200.501 requires any non-federal entity expending $1 million or more in federal awards during its fiscal year to have a Single Audit conducted for that year. Nonprofits are non-federal entities for this purpose regardless of their size or structure.
A nonprofit that receives one direct federal award and several subawards from state-administered programs needs to aggregate all federal expenditures to determine whether it crosses the threshold. Federal expenditures from all sources count together toward the $1 million threshold.
Nonprofits below the threshold are exempt from the formal audit requirement for that year but must keep all records available for review by federal agencies, pass-through entities, and the Government Accountability Office.
For a full explanation of what the Single Audit covers, how major programs are selected, and what findings mean for your organization, see the audit section of this guide.
SAM.gov Registration Is Required for Federal Award Recipients
Any nonprofit receiving a direct federal award must be registered in SAM.gov with an active Unique Entity Identifier. SAM.gov registration must be renewed annually. A lapsed registration can delay payments, create reporting complications, and affect the organization's ability to receive or manage federal funds.
Nonprofits receiving funds only as subrecipients also need an active UEI because pass-through entities are required to verify subrecipient eligibility in SAM.gov before making subawards.
The Rural Impact Group provides free SAM.gov registration support for nonprofits navigating the registration and renewal process.
Work With The Rural Impact Group
The Rural Impact Group works with nonprofits across the country managing federal awards as both direct recipients and subrecipients. We provide compliance reviews, external compliance officer services, financial management system configuration guidance, and ongoing advisory support for organizations building federal grant management capacity.
If this guide identified gaps in your current practices, a Rural Impact Diagnostic is the right place to start.
This guide reflects the current text of 2 CFR Part 200 as of May 29, 2026. It is informational in nature and does not constitute legal advice. Organizations should consult qualified compliance professionals when making compliance determinations for specific awards.