Your organization won a Nonprofit Security Grant Program award. The vendor has been paid. Six weeks later, the money still has not arrived, and nobody at the state can tell you why.
This is the most common post-award experience we see, and it almost never means something has gone wrong with the award. It usually means the reimbursement package is missing one document, or the request is sitting in a federal review layer most awardees do not know exists.
Here is what the state needs from you, why packages get returned, and how long the money actually takes.
The Short Answer
NSGP is a reimbursement program. Your organization pays the vendor from its own funds first. You then submit a documentation package to your State Administrative Agency (SAA), the state office that administers NSGP on FEMA’s behalf. Once that package clears review, the SAA reimburses you.
A complete package proves four things: that the work was approved, that it happened inside the award period, that you followed the procurement rules, and that the money actually left your bank account. Miss any one of those and the package comes back.
Most reimbursement problems are not denials. They are returns. The reviewer sends the submission back with a note, and the clock starts over.
One Important Exception
The reimbursement structure is nearly universal, but it is not written into federal law as an absolute. A small number of state programs allow other payment methods.
Illinois is the clearest example. The Illinois Emergency Management Agency and Office of Homeland Security states that it may disburse funding to grantees “by the advance payment method, reimbursement method, or working capital advance method” under 29 Ill. Adm. Code 120.50(d).
That is unusual. Assume reimbursement unless your state’s award documents say otherwise in writing. Do not assume an advance is available because a colleague in another state received one.
The Documentation Package: Seven Items
Form names and upload mechanics differ by state. The underlying evidence does not, because the federal rule at 2 CFR Part 200 applies everywhere.
FEMA’s Preparedness Grants Manual lists the documentation recipients and subrecipients must maintain for federally funded purchases: specifications, solicitations, competitive quotes or proposals, the basis for selection decisions, purchase orders, contracts, invoices, and canceled checks. A reimbursement package is that list, organized.
1. The state reimbursement form. Signed by the authorized representative on file from award acceptance. If your executive director changed since the award, the SAA needs an updated signatory letter before it will accept the form.
2. The vendor invoice. Itemized, dated inside the period of performance, and addressed to the organization rather than to an individual or a related entity. Line items should track the approved budget language. If the budget approved six rated bollards, the invoice should not read “perimeter work, lump sum.”
3. Proof of payment. This is the item that stalls the most submissions. The reviewer needs evidence that funds left your account: a cleared check image front and back, a bank statement page showing the transaction, an ACH or wire confirmation, or a card statement page matched to the invoice. An invoice stamped PAID is not proof of payment. Neither is an accounting screenshot.
4. Budget mapping. A short worksheet tying this invoice to a specific approved budget line, showing how much of that line remains.
5. Procurement documentation. For purchases above the micro-purchase threshold, the package includes the vendor list, the quotes received, the selection rationale, and the contract or purchase order.
6. An asset record for equipment. Description, serial number, location, custodian, acquisition cost, and date placed in service. NSGP-funded equipment carries a federal interest that outlasts the award.
7. EHP clearance reference, when applicable. If the work required Environmental Planning and Historic Preservation review, the package references the clearance.
The Procurement Thresholds Changed
This is the correction we make most often on active awards.
Effective October 1, 2025, the federal micro-purchase threshold rose from $10,000 to $15,000, and the simplified acquisition threshold rose from $250,000 to $350,000. Per the FY 2026 NSGP Notice of Funding Opportunity, these updated figures apply to recipient and subrecipient procurements executed on or after that date, including on awards that were already open.
So an organization operating under a FY 2024 or FY 2025 award is not locked into the old numbers. Procurements it runs today use $15,000.
Two related rules catch nonprofits regularly.
You are expected to have a written procurement policy. Nonprofit subrecipients must have and use their own documented procurement procedures that conform to 2 CFR 200.318 through 200.327. If your organization has no documented procedures, you must follow the federal rules directly. Most congregations have never written a purchasing policy, which means they default into the full federal standard without realizing it.
The vendor who helped with your application may be barred from the job. Under 2 CFR 200.319(b), contractors who develop specifications, statements of work, or solicitations are excluded from competing for those procurements. FEMA interprets this as applying to contractors who help develop the grant application, project plans, or project budget. The rule extends to former employees. If a security integrator assisted with your application and you then buy from that integrator, the procurement may be disallowed.
Two Rules That Disqualify Otherwise Good Purchases
Pre-award costs. The FY 2026 NOFO permits pre-award costs for the SAA with prior written FEMA approval, then states plainly that subrecipients cannot claim pre-award costs. Work performed before the period of performance opens is not reimbursable regardless of how well it fits the funded scope.
Covered telecommunications equipment. FEMA prohibits spending award funds on covered telecommunications equipment or services, addressed in FEMA Policy 405-143-1. Several camera and recorder manufacturers fall under this prohibition, and they sit squarely in the price range many organizations shop. An approved equipment category purchased from a prohibited manufacturer is still unreimbursable.
One more item that is easy to miss: FEMA requires a domestic preference provision in all contracts and purchase orders for work or products. The Preparedness Grants Manual publishes sample clause language. A purchase order missing it can become a finding even when the purchase itself was appropriate.
Why Reimbursement Takes So Long
There is a federal review layer between your submission and your money, and it is the part awardees almost never account for.
FEMA reviews all grant payments and obligations for allowability under 2 CFR 200.305. All non-disaster grant reimbursement requests must be reviewed and approved by FEMA before drawdown. For recipients other than states, 2 CFR 200.305(b)(3) directs FEMA to make reimbursement payments within 30 days of receiving the request, unless FEMA has reason to believe the request is improper.
If FEMA needs more information, it issues a request for information. Recipients are strongly encouraged to respond within three business days. If an adequate response does not come back, the request may be denied, a new one may be required, and the 30-day timeline restarts.
So the sequence runs: you pay the vendor, you submit to the SAA, the SAA reviews, the SAA requests funds from FEMA, FEMA reviews, and then the money moves. When your state contact says they are waiting on the federal side, that is frequently accurate.
Reporting compliance sits on top of this. FEMA may withhold cash payments if Federal Financial Reports are not timely, complete, detailed, and accurate. Reports showing inadequate progress can trigger the same result. A late report can freeze a reimbursement that was otherwise clean.
Across our client awards, we plan for roughly 60 to 90 days from vendor payment to cash in hand on a first submission that clears without a return. That is our observation, not a published standard, and it varies by state.
The 5 Percent Nobody Uses
The FY 2026 NOFO allows nonprofit subrecipients to expend up to 5 percent of each subaward on management and administration. The NOFO names the qualifying work directly: preparing and submitting required programmatic and financial reports, establishing and maintaining equipment inventory, documenting equipment and operational expenditures for financial accounting, and responding to information requests from state and federal oversight authorities.
That is the exact labor this article describes. On a $150,000 subaward, it is $7,500. Most organizations never budget it and end up absorbing the administrative cost out of general operating funds.
If your organization holds more than one subaward, you must be able to account for M&A separately for each.
Planning Cash Flow Around the Gap
The award is real. The cash is not in your account. Those are different facts, and the gap between them is where organizations get into trouble.
A few practical points:
- Stage procurement. Do not carry more open reimbursement balance at once than the organization can absorb for 90 days.
- Use net-30 vendor terms where you can. Submitting the package on the day you pay narrows the squeeze considerably.
- Do not commit to a multi-vendor sequence without modeling the cash. Organizations without a line of credit or liquid reserves should sequence rather than parallel-track.
- Know your actual period of performance. The federal FY 2026 NSGP period runs September 1, 2026 through August 31, 2029, a full 36 months. State programs are often much shorter. California’s FY 2025 CSNSGP period runs March 1, 2026 through December 31, 2027, and Cal OES has said it will consider only a 30-day extension because of state budget encumbrance limits. Pacing a California project on a 36-month mental model will run you out of runway.
If You Hold Both a Federal and a State Award
This is where multi-program awardees most often stumble. The rules are not the same, and applying one program’s threshold to the other program’s purchase fails review.
Compare federal NSGP to New York’s Securing Communities Against Hate Crimes program. Federal competition requirements attach above the $15,000 micro-purchase threshold. Under the 2026 SCAHC request for applications, the tiers are:
- Purchases up to $5,000 at the grantee’s discretion
- Purchases between $5,000 and $50,000 require at least three written quotes on vendor stationery, retained on file
- Purchases over $50,000 require a competitive bidding process
- Purchases above $50,000 without competitive bidding require prior written DCJS approval on a Single or Sole Source Authorization Form
A $6,000 purchase that is entirely compliant federally needs three documented quotes under SCAHC. Run two parallel workflows with separate files. Do not merge them.
What Happens After You Get Paid
Approval is not the end of the exposure.
Federal records must be retained for at least three years from the date the final Federal Financial Report is submitted, under 2 CFR 200.334. If no final report is submitted and the award is administratively closed, the retention clock starts at closeout instead. Subrecipients must submit closeout materials within 90 calendar days of the subaward period end date.
FEMA may place a hold on funds or impose additional conditions under 2 CFR 200.208 and 200.339 when noncompliance surfaces, including after an award has closed. Organizations expending $1,000,000 or more in federal awards during a fiscal year must undergo a single audit or program-specific audit. Most NSGP awardees are well under that line, but organizations running several grant streams should check.
If EHP review applies to your project, note the timing: projects that may need an Environmental Assessment must be identified to the FEMA headquarters preparedness officer within six months of award, and completed EHP materials must be submitted no later than 12 months before the period of performance ends.
What This Means for Your Organization
Three things determine whether reimbursement goes smoothly.
Build the file at the moment of purchase, not at submission. Quotes, selection rationale, purchase order, and the domestic preference clause are easy to assemble in the week you buy and painful to reconstruct four months later.
Capture proof of payment the day you pay. Pull the cleared check image or the bank statement page immediately and file it with the invoice.
Read your own award documents for the state-specific rules. Period of performance dates, procurement tiers, portal requirements, and payment method all vary. The federal rules are the floor, not the whole picture.
An organization that does those three things clears most reviews on first submission and gets paid on the shorter end of the range.
Not sure where your package stands? If reimbursements have stalled, or you want a second set of eyes before you submit, we are happy to talk it through. You can book a free consultation with SGA here.
Official Sources
Every claim in this guide traces back to a primary federal source. Confirm current cycle and post-award requirements at the official URLs below before submitting reimbursement packages.
- FEMA Nonprofit Security Grant Program (NSGP): https://www.fema.gov/grants/preparedness/nonprofit-security
- 2 CFR Part 200 (Uniform Guidance for federal awards): https://www.ecfr.gov/current/title-2/subtitle-A/chapter-II/part-200
- SAM.gov (Unique Entity Identifier and registration): https://sam.gov/
- SAM.gov Exclusions (federal debarment search): https://sam.gov/content/exclusions
- Grants.gov opportunity portal: https://www.grants.gov/
- FEMA Environmental and Historic Preservation (EHP) review: https://www.fema.gov/grants/tools/environmental-historic-preservation
- U.S. Department of Homeland Security: https://www.dhs.gov/
State Administrative Agencies publish state-specific reimbursement portals, forms, and per-state checklists. Confirm the current SAA contact for your state through the FEMA grants portal above.