Compliance guide
Compliant outreach for financial advisors: working within FINRA, SEC, and recordkeeping rules
Cold outreach is allowed for financial advisors when it follows the rules that govern advertising, communication, and recordkeeping in the industry. This guide covers the main rules: CAN-SPAM for email, FINRA Rule 2210 for broker-dealer communications, the SEC marketing rule for RIAs, and the recordkeeping rules that require you to archive what you send. It then shows how Finterest is built to support each one. This is general information, not legal advice. Your firm's compliance team has the final say on what you can send.
Finterest is built to support compliant outreach for financial advisors: it supports pre-send message review so communications can be checked before they go out, keeps a record of outreach so messages can be retained and reviewed, and provides one-click unsubscribe on email. It supports your firm's compliance process; it does not replace your firm's supervision or approval. This is general information, not legal advice.
Scope: who this guide covers
Regulatory requirements vary by license type. The guidance here reflects rules for securities-licensed advisors and firms (FINRA and SEC). Insurance-only producers are regulated by state insurance departments and NAIC model rules, and remain subject to the FTC Telemarketing Sales Rule and TCPA for calls. Confirm your own obligations with your firm's compliance team.
What does CAN-SPAM require for advisor email?
CAN-SPAM requires that every commercial email identify itself honestly, include a valid physical mailing address, and give the recipient a working way to opt out that you honor promptly. It applies to all commercial email, not just advisors. In practice that means accurate “from” and subject lines, no misleading routing, a real address in the footer, and an unsubscribe link that actually works and is processed within ten business days.
What is FINRA Rule 2210 and how does it affect outreach?
FINRA Rule 2210 governs the communications of FINRA-registered firms and separates them into three categories with different review requirements. The category determines whether a registered principal has to approve the message before it goes out.
The three categories:
- Correspondence: written or electronic communication sent to 25 or fewer retail investors within any 30 calendar-day period. Lighter supervision, generally no pre-use principal approval, but it must be supervised and retained.
- Retail communication: any written communication distributed to more than 25 retail investors within 30 calendar days. This generally requires principal approval before use and must meet content standards.
- Institutional communication: communication to institutional investors only, with its own handling.
The practical takeaway: the moment your outbound reaches more than 25 retail investors in a rolling 30-day window, it is usually treated as retail communication and needs principal approval. A tool that keeps messages reviewable before they send, and keeps a record, is what makes this manageable at volume.
What is the SEC marketing rule for RIAs?
The SEC marketing rule (Rule 206(4)-1 under the Investment Advisers Act) governs how registered investment advisers advertise, including outreach that promotes the firm. It prohibits untrue or misleading statements, unsubstantiated claims, and selective or cherry-picked performance, and it sets specific conditions for testimonials, endorsements, and performance figures. For outreach, the core duty is simple to state and easy to violate by accident: be fair, be accurate, and be able to back up what you say.
Do advisors have to archive LinkedIn messages and emails?
Yes. Advisers must retain business-related electronic communications, including email and LinkedIn messages, under SEC Rule 204-2, generally for five years with the first two years in an easily accessible place. FINRA has parallel recordkeeping expectations for broker-dealers. LinkedIn direct messages and other interactive social content count as business communications when they relate to the firm's business, so they have to be captured and retained, not left only in the platform.
How does Finterest support these requirements?
Finterest builds the process these rules require into the product. It supports pre-send message review so communications can be checked before they go out, keeps a record of outreach so messages can be retained and reviewed, includes clickwrap terms with a server-side audit trail, isolates each user's data, encrypts credentials with AES-256, and provides one-click unsubscribe on email. Call-recording disclosure controls are off by default pending firm legal review. Finterest supports your firm's compliance process. It does not replace your firm's supervision or approval.
The rules at a glance
| Rule | Who it applies to | What it governs | What it means for outreach |
|---|---|---|---|
| CAN-SPAM | Anyone sending commercial email | Email identification, address, opt-out | Honest headers, physical address, working unsubscribe honored promptly |
| FINRA Rule 2210 | FINRA-registered firms | Communication categories and approval | Over 25 retail investors in 30 days usually needs principal approval |
| SEC Rule 206(4)-1 | RIAs | Advertising and marketing content | No misleading or unsubstantiated claims; back up what you say |
| SEC Rule 204-2 | RIAs | Recordkeeping | Retain email and LinkedIn business messages, generally five years |
Go deeper on the rules
Is cold email allowed for financial advisors?
The direct answer, plus the rules that apply: CAN-SPAM, FINRA 2210, the SEC marketing rule, and recordkeeping.
FINRA Rule 2210 explained
Correspondence vs retail communication, the 25-investor threshold, and when principal approval is needed.
The SEC marketing rule for advisors
What Rule 206(4)-1 prohibits and conditions, and what it means for cold outreach.
Do advisors have to archive LinkedIn and email?
Why business email and LinkedIn messages are records, and how long they must be retained.
Frequently asked questions
Is cold email allowed for financial advisors?
Yes, when it follows CAN-SPAM and the communication and recordkeeping rules that apply to your registration. That means honest headers, a physical address, a working opt-out, accurate claims, and retained records.
How many people can I email before it needs compliance approval?
For FINRA-registered firms, reaching more than 25 retail investors within a 30 calendar-day period generally moves your message from correspondence to retail communication, which usually requires principal approval before use.
Do I have to keep records of my outreach?
Yes. RIAs must retain business-related electronic communications, including email and LinkedIn messages, generally for five years under SEC Rule 204-2. Broker-dealers have parallel FINRA recordkeeping obligations.
Does Finterest replace my firm's compliance review?
No. Finterest provides pre-send review, audit trails, archiving, and disclosure controls, but your firm's compliance team remains responsible for supervision and approval.
Is Finterest approved by FINRA or the SEC?
No. There is no FINRA or SEC approval for software, and Finterest does not claim any. Finterest is built to support compliance in outreach, with pre-send review, recordkeeping support, audit trails, and disclosure controls, but it does not replace your firm's supervision or approval. This is general information, not legal advice.
Last reviewed: June 2026