Compliance in marketing for financial institutions is the activity of creating marketing activities without being stopped by regulatory agencies, chief compliance officers, or state regulators.
There are regulations that relate to each firm type, and they change yearly. These regulations rarely align perfectly within the same template of a generalist marketer.
This guide will provide the relevant federal and state regulations that apply to all firm types, with a cross-firm matrix at the end to allow marketers at multiple line firms to identify which regulations apply to their firm and which do not.
This article does not provide legal advice. Any potential marketing campaign should be reviewed by your internal compliance department and external attorneys prior to release.
Why Compliance Is Different in Marketing Financial Institutions: Navigating Compliance Risks for Financial Services Companies
There are three factors that create a distinction in marketing compliance for financial institutions compared to any other regulated category:
Overlap among regulators. A bank holding company with an RIA subsidiary, a broker-dealer subsidiary, and an insurance agency subsidiary receives oversight from the Office of the Comptroller of the Currency (OCC), Securities Exchange Commission (SEC), Financial Industry Regulatory Authority (FINRA), Consumer Financial Protection Bureau (CFPB), and various state insurance departments regarding different aspects of a single branded marketing campaign.
Variation among firm types. The SEC Marketing Rule (Investment Advisers Act §206(4)-1) regulates RIAs. FINRA Rule 2210 regulates broker-dealers. CFPB regulations regulate consumer lending. State insurance commissioners regulate marketing of insurers under National Association of Insurance Commissioner (NAIC) model rules. Federal Trade Commission Act Section 5 (FTC Act Section 5) regulates all remaining categories.
An advertising claim that complies with the regulations for an RIA may result in violation of regulations for an affiliated broker-dealer if the identical advertising materials are published.
Weighted recordkeeping. Financial service firms are subject to regulation on what constitutes a record (e.g., every email, social media posting, advertisement, video script) and how long such records must be maintained. Broker-dealers are required to maintain records pursuant to Rule 17a-4 while RIAs are required to maintain records as described in the Books and Records section of the Investment Advisers Act.
In addition to maintaining electronic files, there are also requirements to archive those files.
The 2025 SEC Risk Alert on the Marketing Rule noted deficiencies in disclosures and recordkeeping with respect to 2026 Exam Priorities continuing to address program effectiveness (smartasset.com). Wolters Kluwer provides an overview of the policy and process posture most firms must adopt (wolterskluwer.com).
For related information about developing a marketing strategy for your financial institution see Financial Services Marketing Strategy.
SEC Marketing Rule for RIAs
The SEC Marketing Rule was established on December 22, 2020, with a full compliance date of November 4, 2022. The new rule updates the provisions of Investment Advisers Act §206(4)-1, which previously addressed restrictions on advertising and cash solicitations, and provides a broad, principles-based approach to governing the advertising activities of registered investment advisers.
An “advertisement” is defined very broadly as any form of direct or indirect communication made by an investment adviser when making an offer of advisory services with respect to securities to potential clients or investors.
Therefore, this definition includes website materials, social media posts, email correspondence, videos, podcasts, sponsored content, and virtually all forms of testimonials and endorsements.
Seven general prohibitions in the rule form the foundation on which an advertisement is judged. An advertisement may not: state an untrue material fact or omit a fact needed to keep it from misleading; make a material statement the adviser cannot substantiate on demand; include information likely to cause an untrue or misleading implication or inference; discuss benefits without fair and balanced treatment of the material risks or limitations; refer to specific investment advice in a way that is not fair and balanced; include or exclude performance results, or present performance periods, in a way that is not fair and balanced; or be otherwise materially misleading.
Testimonials & endorsements. Testimonials & endorsements are permitted, subject to certain limitations. A testimonial is a statement from a current client of the investment adviser. An endorsement is a statement from a non-client of the investment adviser.
In either case, both require clear and prominent disclosures regarding the identity of the individual who provided such a testimonial/endorsement; if the individual providing such a testimonial/endorsement was compensated in any way (either in cash or non-cash); and a concise statement of any material conflict(s) of interest. Advisers managing paid promoter or client referral programs are subject to strict rules concerning compensation agreements and prominent disclaimers.
If an individual receives greater than $1,000 in compensation for their testimonial/endorsement over a twelve-month period, then the investment adviser must have a written agreement with that person setting out the scope of the arrangement and the terms of compensation before the testimonial or endorsement is used.
Third-party ratings. Third-party ratings are allowed, but must include disclosures regarding the date such a rating was given; the period covered by the rating; the third-party entity that developed such a rating; and if the third-party entity received any compensation for developing such a rating.
Performance. Performance net-of-fees, performance time frames, and standardized presentations are critical elements to consider. Hypothetical performance creates additional disclosure burdens, and may only be used when directed towards individuals that would reasonably be able to understand hypothetical performance. Recordkeeping related to predecessor performance also contains additional substantiation requirements.
In its 2025 risk alert addressing compliance issues related to the SEC Marketing Rule, the commission cited several common errors committed by registered investment advisers, including failing to provide required disclosures relating to testimonials; failing to provide adequate disclosures regarding third-party ratings; and failing to properly maintain records associated with advertisements.
For further information on video-specific references to the SEC Marketing Rule for RIAs please visit SEC Marketing Rules for video & social media and compliance-friendly RIA marketing playbook.
FINRA Rule 2210 for Broker-Dealers
FINRA Rule 2210 governs communications made by broker-dealers, categorizing communications as retail communications, correspondence, and institutional communications. Each category has unique supervision and filing requirements.
Retail communications. Distributed to more than 25 retail investors in any 30 calendar day period. Requires principal approval prior to use (with limited exemptions). Some categories (mutual fund & variable insurance product communications) will require filings with FINRA.
Correspondence. Distributed to 25 or less retail investors in 30 days. Must be reviewed pursuant to the firm’s written supervisory procedures (WSPs); generally no pre-use principal approval required.
Institutional communications. Distributed exclusively to institutional investors. Firms must implement internal supervisory procedures; no pre-use principal approval required.
All three categories fall under Rule 3110. This rule requires firms to develop and implement written supervisory procedures (“WSPs”) to ensure compliance with applicable securities laws and FINRA rules. All marketing communications must follow a clearly defined supervisory pathway, and the firm must demonstrate that the pathway was followed.
Broker-dealer recordkeeping requirements are governed by Rule 17a-4 (recordkeeping requirements under Section 17(a) of the Securities Exchange Act of 1934). All communications must be retained for at least three years. For the first two years, communications must be kept in an easily accessible location.
Recordkeeping related to electronic communications must meet specific format requirements (originally WORM format; amended in 2022 to allow audit trail alternatives).
Ad content standards. Communications must be fair and balanced. May not omit material facts. May not contain false/misleading statements. May not predict/project performance. May not imply guarantees. Prior results do not guarantee future success.
To find more about how to comply with FINRA Rule 2210 specifically through video formats please click on video reference to FINRA Rule 2210.
CFPB Rules for Advertising Consumer Financial Products: Fair Lending and Mandates for Credit Unions
Several CFPB rules and the broader UDAAP rule created by Dodd-Frank Section 1031 and 1036 are applicable to the advertising of consumer finance products. UDAAP prohibits an unfair, deceptive or abusive act or practice.
The advertising of consumer credit is regulated by Regulation Z (the Truth in Lending Act, 12 CFR §1026) that separates open end credit (HELOCs, credit cards, §1026.16) from closed end credit (loans, mortgages, §1026.24).
Any term advertised for both types of credit must be offered, and any triggering terms (the amount or percentage of a down payment, the number of payments or period of repayment, the amount of any payment, or the amount of any finance charge) require additional disclosures of total payments made over the life of the product, repayment period, and Annual Percentage Rate (APR) (consumercomplianceoutlook.org).
In addition to the general advertising requirements outlined above, dwelling secured credit requires the inclusion of additional rate and payment disclosures (consumerfinance.gov).
America’s Credit Unions provides the practical application for community lender compliance regarding open and closed end credit advertising requirements (americascreditunions.org).
Regulation B (ECOA) & Marketing Implications
Regulation B implements the Equal Credit Opportunity Act, which prohibits discrimination in any aspect of a credit transaction on the basis of race, colour, religion, national origin, sex, marital status, age, or receipt of public assistance. Marketing implications of this regulation include that all forms of targeting cannot exclude members of protected classes, that no form of creative can indicate a preference based upon one of these factors, and that all landing pages related to credit applications cannot deter any applicant on a basis prohibited by Regulation B.
The NCUA’s Regulation B Reference Guide covers specific regulations for credit unions (ncua.gov).
Triggering Terms: How They Work in Practice
Wipfli explains what constitutes a “triggering term” in Regulation Z advertising and how to avoid non-compliance issues due to limited space in paid social or display ad headlines (wipfli.com).
In short: do not place “triggering terms” in headlines where there will not be enough room for a proper disclosure; direct users to a landing page with complete and accurate disclosure information. Deposit products and high-yield accounts fall under the Truth in Savings Act and Regulation DD (12 CFR 1030), which require a full schedule of terms and a standardised APY disclosure.
State Insurance Regulators
Insurance regulation is conducted at the state level through McCarran-Ferguson. The National Association of Insurance Commissioners (NAIC) creates model laws and regulations that states may elect to follow with changes.
Models for insurance marketing exist in the Variable Contract Model Law and many models related to advertising, which vary among the states such that there will be a difference between how a given marketing effort would be treated in California, Texas, and New York. Models may be reviewed in the NAIC model laws index and its PDF version.
An overview of the adoption-and-variations process is provided by Radar First’s NAIC Overview.
Practical Implication. If a marketer wishes to execute a national insurance campaign they will need to conduct a review of each state where the campaign will operate, particularly if the campaign involves life, annuity, or variable products.
In addition to a review of the applicable laws, some states require marketers to file their advertisements before they are distributed (pre-filing); others require approval after filing; and all require recordkeeping to demonstrate compliance.
FTC Act §5: Federal Trade Commission Standards Governing Modern Financial Marketing
Section Five of the Federal Trade Commission Act prohibits “unfair” or “deceptive” trade practices, and it regulates general advertising of all types. Financial services companies primarily regulated by another regulatory body are still responsible to the FTC for advertising in general.
To meet the deception standard, a representation, omission, or practice must be material and likely to mislead a reasonable consumer. To meet the unfairness standard, there must be a substantial injury to consumers that cannot be avoided by them, and the injury must exceed any benefits associated with the challenged practice.
Thus, for marketers, there are two primary obligations. First, there must be substantiation for claims made — i.e., any objective claim must be supported by competent and reliable evidence at the time of making the claim.
Second, there must be adequate disclosure of material information necessary to prevent deception of customers so long as that information is presented clearly and conspicuously. The FTC has developed guides for endorsements and testimonials including those by influencers and reviewers, and requires that marketers disclose material connections between endorsers and advertisers.
GLBA (Privacy Rules Affecting Marketing)
The Gramm-Leach-Bliley Act (“GLBA”) (15 U.S.C. §6801-6809) sets forth the requirements for how financial institutions treat non-public personal information about their customers. The GLBA consists of two main components: the Privacy Rule and the Safeguards Rule.
For marketers, the GLBA restricts the ability to utilize customer non-public personal information (“NPI”) for purposes of personalized marketing or targeting. Additionally, sharing NPI with unaffiliated third-party service providers (e.g., certain marketing vendors) typically requires an exception or notice to customers of their right to opt out.
Finally, utilizing customer information obtained from one financial product to promote other products to the same customer(s) typically requires providing notice to those customers first.
Practical Implication. Any form of customer-data-driven personalization or paid targeted audiences based on customer transactional data requires GLBA review. Campaigns that involve customer transactional data for CCO review are typically much more complex than those involving only marketing database information for CCO review.
CAN-SPAM, TCPA, State Do Not Call Lists
CAN-SPAM and TCPA apply to all firm types.
CAN-SPAM (15 U.S.C. §7701): Requires commercial email senders to clearly label their emails as ads, include a valid mailing address, allow recipients to opt-out of future communications with a clear method, and honor those opt-outs within 10 business days. It further forbids misleading subject lines.
TCPA (47 U.S.C. §227): Applies to SMS and automated dialing systems. Generally requires prior express written consent for telemarketing messages delivered via automated dialing system or pre-recorded voice. Many cases are currently being litigated regarding what constitutes consent. TCPA exposure is calculated per message, so class-action settlements in this area have run very large.
State Do Not Call Lists: A number of states maintain their own Do Not Call lists in addition to the national registry. Marketers must scrub against both registries. Some states (e.g., Florida, Oklahoma) require special disclosures and/or obtain advance consent before engaging in certain forms of telephone solicitation or SMS messaging.
Many marketers underestimate the risk posed by failing to comply with CAN-SPAM and TCPA when executing large-scale email or SMS campaigns. Failing to properly comply with even one provision of either law could expose your company to class-action liability that far exceeds potential ROI gains from running such a campaign.
Designing a Compliant Digital Marketing Workflow: Helping Compliance Teams Solve Compliance Challenges
There are four attributes that define compliance workflows that will survive at scale:
Templated Disclosures. There should be a pre-approved template-based disclosure block available per firm-type and channel, as well as a centrally managed CCO approved block that can be reused by all marketers to avoid having each one re-create the same thing. Each block resides within a central design system where templates can be updated.
Pre-use Approval Routing. All marketing campaigns, retail communications, and testimonials go through an assigned CCO reviewed window of time prior to use. This is a feature built into the campaign calendar rather than an additional step.
Recordkeeping Integration. Upon publishing, every email, ad, video, post, etc. enter the archive immediately. The archive(s) must comply with Rule 17a-4 for broker-dealers and the Advisers Act Books & Records for RIAs.
Firms regulated by the CFPB must also retain records related to the products they offer according to specific lines of business.
Training and Supervision. Quarterly training on new regulatory developments impacting the marketer’s role, in addition to documented supervision from supervisors based on Rule 3110 for broker-dealers or the designated CCO for other firms.
A Sondhelm Partners article provides an excellent operational resource for understanding the compliance challenges financial marketers face (sondhelmpartners.com).
Recent Enforcement Examples
Since 2024-2025 there have been patterns identified in the enforcement actions taken by the SEC, FINRA and CFPB.
The SEC Risk Alert issued regarding the Marketing Rule specifically cited RIAs for failing to include proper testimony and/or third-party ratings in advertisements; creating performance presentation materials that did not provide a fair and balanced view; and failure to properly maintain advertisement review documentation in accordance with recordkeeping requirements. The 2026 Exam Priorities continue to place the Marketing Rule as a priority area of focus.
FINRA’s Annual Examination Report has consistently found retail communications that were not fair and balanced; social media postings that were not approved by principals; and violations of FINRA Rule 3110 — failure to establish and maintain a system of supervision. The pattern among these areas of noncompliance is directly related to the speed at which a firm is producing social and video content versus how timely supervisory documentation is being completed.
The Consumer Financial Protection Bureau began pursuing claims alleging unfair or deceptive acts or practices (“UDAAP”) against consumer finance companies for misrepresentations made in advertisements, including overstating benefits; burying fees; or misrepresenting who is eligible for advertised services. The pattern here includes advertisers using very aggressive language and losing sight of providing a fair and balanced representation of what is being offered.
State insurance commissioners aggressively pursue enforcement actions related to misleading advertisements, especially those related to life and annuity products. Some states are more aggressive than others; California, New York, and Texas are currently some of the most active.
Cross-Firm-Type Compliance Matrix
The cross-firm-type compliance matrix below represents what applies to whom, the starting point for a CCO discussion, but not a replacement for it.
|
Firm Type |
Primary Regulators |
Testimonials |
Pre-Use Approval |
Recordkeeping |
|
RIA |
SEC (or state for smaller RIAs) |
Permitted under SEC Marketing Rule §206(4)-1 with disclosures |
Review by CCO based on firm policy |
Books & records requirements of the Advisers Act (generally 5 years; first two years in office) |
|
Broker-dealer |
FINRA, SEC |
Permitted under FINRA Rule 2210 with conditions |
Required for retail communications |
Rule 17a-4 (3-6 years depending on category) |
|
Bank/credit union |
OCC, FDIC, NCUA, State regulators, CFPB |
Permitted; truthful and substantiated |
Compliance review by firm |
Bank-specific recordkeeping rules |
|
Insurance company |
State insurance commissioners (NAIC framework) |
Permitted; state specific limits |
Filing with states for some materials |
State specific |
|
Consumer fintech |
CFPB, FTC |
Permitted; FTC Endorsement Guides apply |
Compliance review by firm |
FTC/product specific |
|
B2B fintech |
Varies by service category |
Generally permitted |
B2B review |
B2B |
There are also several cross-cutting rules that apply across all types:
- FTC Act §5 — general advertising
- CAN-SPAM — email
- TCPA/State DNC — SMS
- GLBA — customer NPI use in marketing
Frequently Asked Questions Regarding Financial Services Marketing Compliance
Is my testimonial program safe under the SEC Marketing Rule? Likely yes if you have written policies, disclose when required, written agreements for compensation greater than $1,000 over twelve months, and recordkeeping which shows review. Consult your CCO on each program.
Do I need to get pre-use approval from principal before every post I make to my broker-dealer LinkedIn account? Retail communications typically require principal approval prior to posting. A LinkedIn post counts as a retail communication if it is distributed or made available to more than twenty-five retail investors within any thirty calendar-day period. Firms running an active social programme usually maintain a set of pre-approved post templates so principals are not reviewing every item from scratch.
How long do I keep marketing records? Depends on firm type. Broker-dealers: generally three years under Rule 17a-4; longer for certain categories. RIAs: generally five years under Advisers Act books and records. CFPB regulated firms: varies by product. Verify with your CCO.
Can I use testimonials in video content? Yes. Same disclosure burden as text. Disclosure must be clearly visible and prominent in the video itself, not in the description.
What about using AI generated marketing content? Same rules apply. Firm is liable for the substantiation of claims, required disclosures, and recordkeeping of generated output.
Are these rules applicable to the firm’s video editor or agency? Firm is responsible regardless of vendor or internal producer. Vendor compliance posture should be reviewed as part of due diligence.
If you’re looking at developing a financial services video program and would like to retain an editor that can produce CCO approved content, please forward a sample script. We will create a one minute test edit with a disclosure overlay built into the video.
We deliver in a format your archive can ingest, and we will quote a cadence you can plan around. Vidpros sits in the broader advisor marketing playbook as the production arm rather than the strategy lead.
Please note this article is meant to serve as a reference guide and is not intended to replace obtaining legal advice from qualified attorneys. Rules referenced above change year over year. Additionally, there may be variations in state laws. Obtain guidance from in-house compliance and outside counsel before producing/publishing any specific campaign.
