Introduction
Cold outreach isn't automatically off-limits for financial firms. But what you can send depends on who's sending, who's receiving, which channel you use, what the message says, and how many people get it.
Many compliance teams get stuck on the same questions:
- Does FINRA Rule 2210 apply?
- Is this correspondence or a retail communication?
- Does a principal need to approve it?
- How does Rule 3110 supervision work?
- Which CAN-SPAM, TCPA, SEC, or state rules apply alongside FINRA?
This article answers those questions in plain terms. It is general education only, not legal advice. Confirm every campaign with your compliance officer, FINRA principal, securities counsel, or another qualified adviser before sending.
Key Takeaways
- Rule 2210 covers FINRA member broker-dealers and associated persons; non-member RIAs fall under SEC and state rules.
- Similar outreach to more than 25 retail investors in 30 days may count as retail communication.
- A business owner is not automatically an institutional investor.
- Email, phone, text, and LinkedIn each trigger separate rules.
- Pre-approved messaging, documented supervision, opt-outs, and records hold a program together.
Who Must Follow FINRA Rules During Cold Outreach?
FINRA regulates member broker-dealers and persons associated with them, including registered representatives. An investment adviser that isn't a FINRA member generally answers to the SEC or state securities regulators instead, per FINRA Rule 1210 and SEC guidance on adviser registration.
Dual Registrants and Mixed Campaigns
Dual registrants apply FINRA requirements to their brokerage activity and the Advisers Act Marketing Rule to their SEC-registered adviser activity. A campaign promoting both brokerage and advisory services may need to satisfy both frameworks. Affiliated firms need the same analysis, entity by entity.
The Rulebook Map
| Authority | What it covers in outreach |
|---|---|
| FINRA Rule 2210 | Classification, content, approval, filing, and records for member communications |
| FINRA Rule 3110 | Supervisory system and review of business correspondence |
| FINRA Rule 3230 | Telemarketing: calling hours and Do Not Call restrictions |
| SEC Rule 206(4)-1 | Marketing Rule for SEC-registered or required-to-register advisers |
| CAN-SPAM | Commercial email, with no B2B exception |
| TCPA / FCC rules | Autodialed and prerecorded calls and texts, plus DNC provisions |
| FTC Telemarketing Sales Rule | Disclosures, misrepresentation, and call records |
| Written supervisory procedures | Your firm's own rules, which often go further |
How FINRA Rule 2210 Classifies Prospecting Communications
Rule 2210 sorts every written or electronic communication into three buckets. Audience and distribution decide the bucket, not the label you prefer.
- Correspondence: distributed to 25 or fewer retail investors within any 30 calendar-day period.
- Retail communication: distributed to more than 25 retail investors within any 30 calendar-day period.
- Institutional communication: distributed only to institutional investors.
A retail investor is any person who isn't an institutional investor, whether or not they have an account with the member. Check the current rule text, since FINRA's Rule 2210 page notes a recently approved amendment.
Counting Recipients
Count across the whole program, not one send. Sequences, follow-ups, and message variants that are substantially similar can add up. A three-step sequence to 10 prospects, repeated for new batches inside 30 days, can cross the threshold quickly. Ask your principal how your firm tallies this.
Business Owners Are Not Automatically Institutional
A CEO, CFO, or business owner is usually not an institutional investor by title alone. The definition covers specific categories, such as persons described in Rule 4512(c), governmental entities, and certain large benefit plans. It also bars institutional treatment when you have reason to believe the message will be forwarded to a retail investor. Verify the current definitions and your firm's interpretation.
Approval Basics
Retail communications generally need approval by a qualified registered principal before use or filing. Exceptions exist, including certain non-promotional communications, so check the rule and your written supervisory procedures. Filing with FINRA applies only to specified categories of retail communications, not every prospecting email.
Three Illustrative Scenarios
These are examples, not legal determinations.
| Scenario | Likely treatment | Review and records |
|---|---|---|
| One-to-one note to a single prospect | Correspondence | Risk-based review under Rule 3110(b)(4); retained |
| Small batch of 20 similar emails in a month | Correspondence, if all recipients are retail | Same, but watch the count |
| Templated campaign to 500 retail prospects | Retail communication | Principal approval before use; approval and use dates retained |
What FINRA Allows and Prohibits in Outreach Content
Rule 2210(d) requires communications to be fair and balanced, based on fair dealing and good faith. They can't be false, exaggerated, unwarranted, promissory, or misleading, and they can't omit material facts.
High-Risk Language
Watch for:
- Guaranteed returns or promises of outcomes
- Unsupported savings claims
- Predictions or projections of performance, subject to the rule's listed exceptions
- Cherry-picked performance figures
- Exaggerated client results
- Claims that skip material risks or limitations
FINRA's $850,000 fine against M1 Finance in March 2024 shows the stakes. FINRA's announcement described influencer posts that weren't fair and balanced, and that the firm hadn't approved before use or retained.
"Educational" Is Not a Safe Harbor
A message that promotes your firm, service, security, or strategy gets reviewed, even if you call it educational. A neutral market explainer differs from one ending in "book a call to move your rollover to us."
Channel-Specific Controls
- Email: accurate sender and routing information, a non-deceptive subject line, clear ad identification, a valid postal address, and a working opt-out; honor opt-outs within 10 business days
- Phone: compliant scripts, calling hours (8 a.m. to 9 p.m. local time), and Do Not Call lists; texts can count as TCPA "calls"
- LinkedIn and linked content: review direct messages, landing pages, attachments, and videos as part of the communication
The FTC's CAN-SPAM guide cites penalties up to $53,088 per violating email.
Testimonials and Client Outcomes
Testimonials, endorsements, and case studies carry added duties. SEC-registered advisers face prescribed disclosures, oversight, and written agreements under the Marketing Rule.
FINRA's Regulatory Notice 17-18 says a testimonial on a technical aspect of investing must come from someone with the knowledge to form a valid opinion. Confirm which regime applies before using client outcomes as proof.
How to Supervise, Approve, and Archive Cold Prospecting
Rule 3110 requires written supervisory procedures suited to your business and review of incoming and outgoing business correspondence. A registered principal must complete that review, and the review must be evidenced. Opening a message doesn't count.
Firms may use risk-based post-use review if training, documentation, and follow-up conditions are met.
Pre-Send Approval Checklist
Record the following before launch:
- Exact message and subject line
- Audience definition and expected volume
- Links, landing pages, and attachments
- Required disclosures
- Campaign dates
- Reviewer name and approval date
- Approved personalization fields
Records to Preserve
Preserve these records for each campaign:
- Final message versions
- Recipient lists and delivery records
- Replies, opt-out requests, and suppression lists
- Approvals, review notes, and complaints
- Landing pages and other linked content
Broker-dealer rules under Exchange Act Rule 17a-4(b) require communications to be kept at least three years, the first two easily accessible. Advisers under Rule 204-2 generally keep advertising records five years. Verify current periods with FINRA and SEC sources.
Closing Capture Gaps
LinkedIn inboxes, text apps, personal devices, dialers, and outsourced mailboxes can create gaps. The SEC's off-channel cases (26 firms and over $390 million in August 2024, per SEC's announcement) show the cost. Controls to consider:
- Route all outreach through firm-approved, archived systems
- Prohibit business texting from personal devices
- Archive LinkedIn messages through a capture tool
- Audit vendor mailboxes and dialer logs regularly
Vendor Management
Outsourcing doesn't shift responsibility. FINRA Regulatory Notice 21-29 says members keep continuing responsibility to oversee outsourced activities.
An appointment-setting partner such as TopLead can support list research, outreach execution, and meeting coordination. TopLead states that it follows CAN-SPAM and TCPA and builds opt-out handling into outreach. Still, the regulated firm keeps responsibility for approved content, supervision, records, opt-out handling, and escalation. Put those allocations in a written vendor agreement.
A Compliance-Ready Campaign Workflow for Email, Phone, and LinkedIn
Step 1: Map the Campaign
Before writing copy, identify:
- The regulated entity and the service being promoted
- Recipient type (retail or institutional) and geography
- Channels and expected volume
- Applicable FINRA, SEC, federal, and state rules
State rules vary. Florida's telemarketing statute, for instance, covers texts and voicemails and requires licensing for non-exempt callers.
Step 2: Build a Controlled Message Library
Get principal or compliance approval for every template. Include:
- Approved claims and required disclosures
- Permitted personalization fields
- Compliant call scripts
- Opt-out language
- Version control, so later edits go back through review
Step 3: Launch, Monitor, and Adjust
Launch only through firm-approved systems. Then:
- Monitor replies and complaints
- Honor suppression requests promptly
- Preserve campaign records
- Review performance and compliance indicators together
- Pause and escalate when a claim, recipient category, or workflow changes
Frequently Asked Questions
Can financial advisors cold email or call prospects under FINRA rules?
Yes, with conditions. FINRA member broker-dealers must follow Rules 2210, 3110, and 3230, while non-member RIAs fall under SEC and state rules. CAN-SPAM, TCPA, and firm procedures may also apply.
What is the FINRA 25-person rule for cold outreach?
Written communications to 25 or fewer retail investors in 30 calendar days are correspondence; more than 25 are retail communications. The threshold doesn't remove supervision or recordkeeping duties.
Does every cold email require principal approval?
Not necessarily. It depends on classification, Rule 2210 exceptions, and your written supervisory procedures. Confirm with your registered principal.
Are LinkedIn messages covered by FINRA Rule 2210?
The channel creates no exemption. Direct messages, posts, replies, and linked materials should be classified and retained under your procedures.
Do CAN-SPAM and TCPA rules also apply to financial prospecting?
Yes. FINRA compliance doesn't replace commercial-email, calling, texting, Do Not Call, or state-law duties. Verify current consent, identification, and opt-out requirements.
Can a lead-generation agency conduct outreach for a FINRA member firm?
An agency can provide operational support under a documented vendor arrangement. The firm stays responsible for approved content, supervision, records, suppression requests, and oversight.
