Is cold email allowed for financial professionals?

CAN-SPAM covers everyone who sends commercial email, and it makes no exception for business-to-business email. The industry rules on top of it depend on your registration. If you are dually registered, both columns apply.

State-registered advisers and insurance-only producers follow their own state rules, so confirm which apply to you with your compliance team.

These come from the FTC's CAN-SPAM compliance guide and the rule at 16 CFR Part 316. Every commercial email you send needs to pass all of them.

CAN-SPAM is an opt-out law: it does not require a prospect's permission before your first email, which is why cold email is allowed at all. What it requires is that every message is honest about who sent it and what it is, and that anyone who asks to stop hearing from you stops hearing from you.

• Accurate header information. From, To, Reply-To and routing must identify the person or business who sent the message.
• An honest subject line that matches the content of the message.
• Clear identification as an advertisement. The law leaves room in how you do this, but it has to be clear and conspicuous.
• A valid physical postal address: a street address, a registered USPS post office box, or a registered private mailbox.
• A clear way to opt out that works for at least 30 days after you send, without a fee, without asking for more than an email address, and without any step beyond a reply or a single web page.
• Opt-outs honored within 10 business days, and opted-out addresses never sold or transferred.
• Responsibility for anyone sending for you. Hiring a vendor does not transfer the obligation.

The rules above are easier to follow as a routine than as a checklist you run at the end. These five steps put each rule where it belongs in the workflow.

1. Settle the approval path before you write. Decide whether a message is a one-off or a template that will reach many prospects. If it will cross 25 retail investors within 30 days, it is a retail communication for FINRA members and needs a principal's approval before the first send. See FINRA Rule 2210 explained.
2. Write only what you could prove on request. Describe who you help and how. Leave out performance, guarantees, rankings, and testimonials unless your compliance team has cleared them, because each carries conditions under the SEC marketing rule and FINRA's content standards.
3. Build the footer once. Put your postal address and opt-out in a standard footer so no send can go out without them, and route replies like “please remove me” into the same suppression list.
4. Send from approved templates, and review the rest. Keep volume sends on templates that have been approved, and have a person read anything new or AI-drafted before it goes out.
5. Keep the record from day one. Retain what was sent, to whom, and any approvals. See archiving LinkedIn and email for retention periods.

• Treating follow-ups as exempt. Each follow-up is its own commercial email, so each one needs the postal address and a working opt-out, not only the first message.
• Fake reply subject lines. Starting a cold email with “Re:” or “Following up on our call” when there was no call is the kind of deceptive subject line CAN-SPAM prohibits.
• Missing “remove me” replies. An opt-out request counts however it arrives. A reply that says “stop emailing me” has to reach the suppression list within 10 business days.
• Sending from accounts the firm cannot capture. A personal inbox used for prospecting is still sending business communications, and those still have to be retained.
• Reusing website copy without a second look. A claim that passed on your website still has to be accurate and supportable in an email, and a template sent to a list may need its own approval.