FCA, FINRA and SEC Rules on Cold Outreach for Finance Firms

A regulated financial services firm can send cold email and LinkedIn messages to prospects. My rule: read the rulebook first. Then write the email. What the message may say, and who must approve it before it goes, depends on the rulebook that covers the sender:

• UK firm, FCA. A message sent in the course of business that invites or induces someone to engage in investment activity is a financial promotion. An FCA firm must make it fair, clear and not misleading.
• US broker-dealer, FINRA. Rule 2210 treats an email as correspondence if it reaches "25 or fewer retail investors within any 30 calendar-day period." Above 25, it becomes a retail communication, which generally needs approval before use from a registered principal (a FINRA-qualified supervisor at the firm).
• US investment adviser, SEC. Under the Marketing Rule, an email offering advisory services to prospects is an advertisement. One-on-one messages are excluded. A templated email sent to many prospects is not one-on-one, even with each name filled in, and hypothetical performance has its own limit.

Every rule below links to the regulator's own page or the statute. This is not legal advice.

General email law applies on top of these rules. In the UK, the ICO's guide to electronic mail marketing says you can email any corporate body, but "sole traders and some partnerships are treated as individuals."

Those recipients need specific consent, or they must have bought (or discussed buying) something similar from you before and not opted out when you gave them the chance.

The same page adds a caveat for company addresses: "You may also need to consider data protection implications if you are emailing employees at a corporate body who have personal corporate email addresses." Its example is a firstname.lastname address.

If your list is built from named people at companies, that caveat is about your list. The ICO also marks the page itself: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."

For US senders, the FTC's business guide to the CAN-SPAM Act is blunt: "The law makes no exception for business-to-business email." Every message needs a valid physical postal address, and you have 10 business days to act on an opt-out.

This is not legal advice.

Is your message a financial promotion at all?

In the UK the starting point is a statute. Section 21 of the Financial Services and Markets Act 2000 says anyone "must not, in the course of business, communicate an invitation or inducement," where the invitation or inducement is to engage in investment activity.

The section also covers claims management activity, which is outside this page. The restriction does not apply if the sender is an authorised person (a firm authorised by the FCA or PRA) or the content has been approved by one. The Treasury can also switch it off, by order, in circumstances it specifies.

The stakes are criminal. Under section 25 of the same Act, a breach can mean up to two years in prison, a fine, or both, on conviction on indictment.

The FCA's Perimeter Guidance, PERG 8.3 says section 21 "contains a number of key expressions or phrases which will determine whether or not it will apply."

Those expressions include "invitation or inducement," "in the course of business," "communicate," "engage in investment activity" and "having an effect in the United Kingdom."

That last one matters for cross-border outreach. Section 21(3) says that for a communication originating outside the UK, the restriction "applies only if the communication is capable of having an effect in the United Kingdom." A US firm emailing UK prospects should put section 21 to counsel too.

For a cold email, the invitation or inducement element does most of the work. PERG 8.4 makes the test objective, and it has two parts.

Would a reasonable observer think that persuading the recipient was the sender's intent or the message's purpose? And would they "regard the communication as seeking to persuade or incite the recipient to engage in investment activity"?

The same guidance says purely factual information is not an inducement, as long as the facts are not presented in a way that turns them into one. Pure profile raising, which names no particular investment or investment service to promote, may not be an invitation or inducement at all.

What that means in practice: an email asking a business owner to book a call about where to put their company's surplus cash reads very differently from a short note introducing the firm and what it covers.

Your compliance lead decides how to classify the message. The person writing the sequence decides which version gets drafted, so pick one on purpose.

The investment activity expression matters too. If the step your message points to is not investment activity as the Act defines it, the section 21 restriction may not reach your outreach at all. That is the first question to put to counsel, along with whether any exemption covers your recipients.

The FCA rules that shape UK outreach

Once a message is a promotion, the core content rule is COBS 4.2.1R(1): the firm has to make sure the communication is fair, clear and not misleading.

That rule is applied proportionately. The same COBS section says a communication to a professional client may not need the same information, or the same presentation, as one written for a retail client. Who receives the message is part of the test.

The channel does not change the standard. The FCA's own financial promotions page applies that same test to every format, from a website post to a tweet.

So a LinkedIn message that counts as a promotion is held to the same bar as an email.

Phone steps have their own section. COBS 4.8 is titled "Cold calls and other promotions that are not in writing." Its application rule lists exceptions, including image advertising and non-retail communications.

Where it applies, it allows a cold call only in narrow cases, such as an established existing client relationship in which the recipient envisages receiving cold calls, or certain packaged products and readily realisable securities.

On any such call, solicited or not, the caller names themselves and the firm at the outset and makes the purpose clear. They call at an appropriate time of day, stop when the person asks, and give a contact point for any appointment made.

A cold email is a written promotion, so the fair, clear and not misleading rule is where it starts. A LinkedIn message is written too, but if a chat turns into a live back-and-forth, ask your compliance lead which section applies.

FINRA Rule 2210 and the 25-person line

For a US broker-dealer, the number that decides the workload sits in the definitions of FINRA Rule 2210:

The trap for B2B outreach is the word "retail." The rule defines a retail investor as anyone who is not an institutional investor, whether or not they have an account with the firm. A business owner on your list can be a retail investor under this rule, even though your campaign is B2B.

Here is the arithmetic. If the same email goes to 200 retail investors within one 30 calendar-day period, the rule's own definition puts it in the retail communication tier, 175 people past the line. Unless one of the rule's approval exceptions applies, it needs a principal's sign-off before the first send.

One of those exceptions is worth knowing for introductory outreach. Rule 2210(b)(1)(D)(iii) lifts the pre-approval requirement for "any retail communication that does not make any financial or investment recommendation or otherwise promote a product or service of the member."

That exception has a condition: the firm must supervise and review such communications the same way it supervises and reviews correspondence under Rule 3110. Whether a given email promotes nothing is a call for your compliance lead.

Rule 2210 adds more. Correspondence and retail communications alike must prominently disclose the member firm's name.

New member firms carry an extra step. For their first year of membership, they file with FINRA, at least 10 business days before first use, any retail communication published or used in electronic or other public media.

The content standards apply to every tier. Communications must rest on fair dealing and good faith, be fair and balanced, and omit no material fact whose absence would mislead. They must not predict or project performance, or imply that past performance will recur, outside a few narrow exceptions set out in the rule.

In outreach copy, check this one first. A subject line built around a past return, or a first line promising what a client "will" see, is exactly the kind of claim the rule describes.

FINRA Rule 3110: who reviews the message, and what is kept

Rule 2210 covers what a message says. FINRA Rule 3110 covers the review around it.

Each member firm needs a supervisory system reasonably designed to achieve compliance with securities laws and FINRA rules.

Rule 3110(b)(4) requires review procedures that cover "incoming and outgoing written (including electronic) correspondence and internal communications relating to the member's investment banking or securities business." Those reviews must be done by a registered principal and evidenced in writing.

Three details matter for outreach.

Replies count. The review covers incoming correspondence, so the replies your sequence produces sit inside the same system as the emails that produced them.

Risk-based review is allowed, with conditions. Under Supplementary Material .06, a firm uses "risk-based principles" to decide what extra review it needs for correspondence outside the Rule 3110(b)(4) subject matters.

The same paragraph then sets the conditions in FINRA's words: "If a member's procedures do not require that all correspondence be reviewed before use or distribution, the procedures must provide for" three things:

• "the education and training of associated persons regarding the firm's procedures governing correspondence"
• "the documentation of such education and training"
• "surveillance and follow-up to ensure that such procedures are implemented and followed"

Opening is not reviewing. Supplementary Material .07 says the evidence of review "must clearly identify the reviewer, the internal communication or correspondence that was reviewed, the date of review, and the actions taken by the member as a result of any significant regulatory issues identified during the review."

It ends with this line: "Merely opening a communication is not sufficient review."

Records follow SEC Rule 17a-4(b). Rule 2210(b)(4) requires the firm to keep all retail communications and institutional communications for that retention period, and the records must name the registered principal, if any, who approved each one, with the approval date.

If someone outside the firm runs the sending, the practical question is simple: are those mailboxes and LinkedIn inboxes inside your capture and review process? Put that on the list of questions to ask any lead gen agency before you sign, next to the questions about results.

The SEC Marketing Rule for investment advisers

Registered investment advisers answer to the SEC Marketing Rule, 206(4)-1, with compliance required since November 4, 2022.

The rule defines an advertisement to include any direct or indirect communication that offers the adviser's investment advisory services with regard to securities to prospective clients. A cold email pitching your advisory service to a prospect fits that wording.

Three exclusions are listed in the SEC's guide:

• One-on-one communications
• Extemporaneous, live, oral communications
• Statutory or regulatory filings

The one-on-one exclusion has two limits that matter for outreach.

Personalization is the first limit. The SEC's adopting release for the rule says bulk emails or algorithm-based messages "addressed to" only one person are "in fact widely disseminated to numerous investors and therefore would be subject to the final rule."

It adds that customizing "a template presentation or mass mailing by filling in the name of an investor and/or including other basic information about the investor would not result in a one-on-one communication." So a sequence that sends one template to many prospects, with each name merged in, does not get the exclusion.

Hypothetical performance also falls outside the exclusion, unless the prospect asked for it unprompted or is a private fund investor.

In practice, a personal note to one prospect stays one-on-one until it adds a hypothetical return the prospect never asked for. Then it is an advertisement.

An advertisement must not:

1. Contain an untrue statement of material fact, or leave out a material fact needed to keep it from misleading
2. State a material fact without a reasonable basis for believing you can substantiate it if the SEC asks
3. Imply something untrue or misleading about a material fact relating to the adviser
4. Discuss potential benefits without a fair and balanced treatment of the material risks or limitations
5. Reference specific investment advice in a way that is not fair and balanced
6. Include or exclude performance results, or present performance time periods, in a way that is not fair and balanced
7. Be otherwise materially misleading

Testimonials and endorsements come with conditions. The ad must clearly and prominently disclose whether the person is a client and whether they were compensated.

Paid promoters need a written agreement, except affiliates and promoters paid $1,000 or less over the preceding 12 months. Certain "bad actors" are barred from acting as paid promoters, subject to exceptions. Advisers must keep copies of every advertisement they disseminate.

On September 11, 2023, the SEC charged nine advisers for advertising hypothetical performance on their websites without the policies and procedures the rule requires.

Penalties ranged from $50,000 to $175,000 per firm, $850,000 combined, and two of the firms had also failed to keep required copies of advertisements.

The channel is no loophole on the broker-dealer side either: FINRA's social media guidance says firms must comply with its communications rule "notwithstanding the medium - social media, email, or print."

In outreach copy, three things bring these conditions into play: a client quote in the message, a performance figure in the first line, and a link to a case study that carries either.

FCA vs FINRA vs SEC, side by side

Rules like these change. The SEC guide dates from April 2021. The FCA promotions page was last updated in May 2024, and the FTC guide in January 2024. The ICO guide is under review. Open the source column before each new campaign, and do not trust any summary, this one included.

Issues to settle before the first send

These are questions to take to your compliance lead or counsel. They are not answers, and working through them does not make a campaign compliant.

1. Which rulebook covers the sender? FCA, FINRA, SEC, or more than one. Then the email law: for UK recipients, is each one a company or a sole trader?
2. Does the message invite or induce the recipient to engage in investment activity? Read it as a reasonable observer would. If it only states facts about the firm, ask whether it falls outside the UK restriction, and whether an exemption covers your recipients.
3. How many retail investors get this exact message within any 30 calendar-day period? For a broker-dealer, that count decides whether it is correspondence or a retail communication.
4. Who approves it, and when? Name the registered principal or the approver, and whether approval must happen before the first send.
5. Is there a performance figure, a projection or a past result anywhere? Check the subject line, the first line and the linked pages, too.
6. Is there a testimonial or endorsement? If so, are client status and compensation disclosed, and is there a written promoter agreement where one is needed?
7. Where do replies land, and are they captured? Every sending mailbox and LinkedIn inbox should sit inside the firm's review and retention process.
8. What gets kept, and for how long? The message, the approval, the reviewer, the date and any action taken.

Settle all eight before anyone writes the sequence. Several answers change the copy itself.

What the rules leave open

My team runs outbound for financial services firms, so I read these rules the way the person writing the sequence has to: line by line, before any copy exists.

The numbers and the process from one financial services engagement are in the outbound teardown. How to find and reach financial advisors in the first place is covered in the financial advisors lead guide, and the financial advisory firms page shows what we do for this sector.

There is also a bar the rules do not set. I once turned down a plastic surgery company that would have paid well, because I found bad reviews about them everywhere I looked. The companies you work with become part of your own reputation, and for me, reputation is more valuable than money.

A prospect judges a financial firm the same way. A message can pass every rule on this page and still read like a firm they would not trust with money.

I am not a lawyer, and this page does not replace your compliance principal or counsel. For vendor sales into banks, see how to sell to banks when vendor reviews decide deals.

If you run outbound for a finance firm and want a second view on the plan before you send, book a call. Rule questions belong with your compliance lead.