This guide is for RIA owners, CCOs, and marketing teams. It shows how to build prospecting around the SEC Marketing Rule, state requirements, communication laws, and your own supervision procedures. The framework is straightforward: approve messaging, choose channels, review, document, and measure both pipeline quality and compliance health.
Key Takeaways
- Build compliance into the workflow, not into a last-minute review.
- No vendor, platform, or agency can certify a campaign or take over your responsibility.
- Substantiate claims, handle testimonials carefully, honor opt-outs, and keep complete records.
- Have the CCO approve every campaign before launch, then monitor it afterward.
What SEC Compliance Means for RIA Prospecting
Map the rules to the firm's registration status
Registration drives which rules apply. Under the general federal thresholds in Section 203A, advisers below $100 million in regulatory assets under management (RAUM) are generally state-registered. Advisers above $110 million generally register with the SEC, and the range in between is a buffer zone.
Exceptions exist, so confirm your status through the SEC's overview and your counsel.
SEC-registered advisers may also have state notice-filing duties. New York, for example, requires a notice filing at six or more New York clients, and that threshold is not national.
Rule 206(4)-1, the Marketing Rule, applies to advisers registered or required to be registered with the SEC. It became effective May 4, 2021, with a compliance date of November 4, 2022. State-registered advisers should check their own state's advertising rules.
Satisfying the Marketing Rule does not make a campaign compliant. These obligations sit alongside it:
- Section 206 antifraud provisions and fiduciary duty
- Rule 204-2 books and records
- Rule 206(4)-7 written compliance policies, annual review, and a designated CCO
- Regulation S-P privacy and safeguards
- CAN-SPAM, the TCPA, and Do Not Call rules
- State securities and telemarketing laws
Identify claims and practices that create the greatest risk
An advertisement cannot contain a materially false statement or omit a material fact. It also cannot present unsubstantiated material facts, create a misleading implication, or show benefits without fair and balanced treatment of risks.
Language that deserves heightened review:
- "Our clients consistently beat the market"
- "Guaranteed retirement income"
- "Top-rated advisor" or any award or ranking
- Any performance figure, especially gross without net, or hypothetical performance
- Claims of special expertise you can't document
Third-party ratings carry extra conditions. You need a reasonable basis that the survey behind the rating is fairly structured, plus disclosure of the rating date, provider, and any compensation. Rule 204-2 also requires you to keep a copy of the questionnaire.
Treat testimonials, endorsements, and referrals as regulated communications
When a client, promoter, or influencer recommends your firm, the rule requires disclosure of whether they are a client and whether they're paid. You must also disclose material compensation terms and conflicts.
Paid promoters generally need a written agreement and adviser oversight. The exception covers affiliates and promoters receiving $1,000 or less (including non-cash compensation) over the preceding 12 months. Run eligibility and disqualification checks before anyone speaks on your behalf.
Build the Compliance Foundation Before Outreach
Define the audience and approved value proposition
Before buying data or writing a sequence, document your ideal client profile, eligibility criteria, service scope, and approved value propositions. Prospecting messages should open a conversation. They shouldn't offer personalized investment recommendations before your normal discovery and suitability process.
Create a controlled content and message library
Pre-approve every reusable asset:
- Email templates and follow-up sequences
- Call scripts and voicemail text
- LinkedIn messages
- Landing pages and event invitations
- Appointment confirmations and disclaimers
Give each item a version number, owner, approval date, and review or expiration date. Retire anything past its date.
Vet data sources, tools, and external partners
Outside help doesn't transfer your obligations. The FTC says hiring an email-marketing company doesn't remove the sender's CAN-SPAM responsibility, and the SEC expects oversight of promoters.
Ask every vendor about:
- Where contact data comes from, and how it's verified
- Consent and opt-out handling, and suppression lists
- Compatibility with your archive
- Security practices, subcontractors, and audit rights
- Staff training
- Incident reporting and breach notification timelines
Under the 2024 Regulation S-P amendments, service providers must notify a covered firm as soon as possible and within 72 hours of becoming aware of a qualifying breach.
When you evaluate vendors, look for operating features such as verified decision-maker appointment-setting across email, phone, and LinkedIn, CRM integration, reporting, and a reschedule or replacement guarantee. TopLead, for example, manually sources and verifies contacts rather than using recycled lists. Like any vendor, TopLead does not certify SEC compliance. Your firm still owns the review.
Which Prospecting Channels Can RIAs Use Compliantly?
Email outreach
CAN-SPAM has no business-to-business exception. Requirements include:
- Accurate header and sender information
- Non-deceptive subject lines
- Clear identification as an ad
- A valid physical postal address
- A working opt-out, honored within 10 business days
Suppress opt-outs across all future campaigns. Send from firm-controlled inboxes so messages land in your archive. Penalties run to $53,088 per violating email under the FTC's guide figure, so verify the current amount.
LinkedIn and other social platforms
Educational posts, connection requests, and direct messages can all work if they run through your review procedures. The risks are practical:
- Automation tools that send unreviewed messages
- AI-generated claims nobody approved
- Disappearing messages and anything you can't retain
The SEC settled cases with two advisers, Delphia and Global Predictions, for $400,000 total over misleading AI statements. In September 2024, its off-channel recordkeeping action included an RIA, Focused Wealth Management, with a $325,000 penalty. If it's a business communication, archive it.
Phone and voicemail prospecting
Use approved scripts and accurate caller ID. Core checks include:
- National Do Not Call Registry (a version no more than 31 days old) and state lists
- 8 a.m. to 9 p.m. calling window for residential telemarketing
- B2B treatment under the Telemarketing Sales Rule (most business-to-business calls are exempt, but the exemption has limits and states can be stricter)
Autodialed or prerecorded calls and texts need appropriate prior consent. TCPA private actions can seek $500 per violation.
Call recording is a state-law question. California, Illinois, Maryland, New Hampshire, Pennsylvania, and Washington are examples of all-party-consent states. Log each call and any appointment it produces.
Referrals, webinars, seminars, and paid introductions
Review compensation arrangements before launch. Seminars may fall outside the first advertisement prong if they are live, oral, and extemporaneous. Paid testimonials or endorsements within them don't. Review invitations, attendee disclosures, gifts, and incentives the same way you would an email.
Websites, content marketing, and lead forms
Educational content, downloads, and landing pages are advertisements if they promote your services. Check disclosures, privacy notices, and any performance references. Test your lead form and chatbot too: the first automated response must match your approved communication policy.
A Practical SEC-Compliant Prospecting Workflow
- Define the campaign. Record audience, purpose, channels, data source, owner, approved claims, call to action, jurisdictions, and compliance reviewer.
- Approve every asset. Route copy, scripts, graphics, landing pages, auto-replies, and confirmations through your documented process. Keep the final version and proof of who approved it.
- Contact prospects through controlled channels. Confirm fit, screen against suppression and opt-out lists, use only approved messaging, and log date, channel, sender, message version, and response.
- Book the appointment. Prospecting should lead to an introductory conversation, not a premature recommendation. Use approved confirmations and disclosures, a rescheduling procedure, and a clear handoff to the adviser.
- Monitor and improve. Review replies, complaints, opt-outs, missed disclosures, no-shows, and vendor activity on a schedule. Pause or revise when something breaks.
Operationalize Supervision, Recordkeeping, and Vendor Oversight
Assign clear ownership and train the people involved
Define ownership across the CCO, marketing staff, advisers, appointment setters, reviewers, and vendors. Train each role on:
- Approved claims and prohibited conduct
- Escalation paths
- Privacy and opt-out handling
Preserve a complete communication record
Rule 204-2 requires copies of advertisements, rating questionnaires, testimonial and endorsement disclosures, and documentation supporting your reasonable-basis belief. Retention is generally five years. Keep these in your approved archive:
- Emails, texts, social messages, and forms
- Scripts, approvals, and disclosures
- Consent and opt-out evidence
- Lead-source information and appointment notes
- Complaints and vendor reports
Test the process as if preparing for an examination
The SEC's December 2025 Risk Alert describes inconspicuous testimonial disclosures, missing promoter agreements, weak promoter oversight, and thin support for ratings. Examiners flagged those gaps, so test for them yourself:
- Sample campaigns periodically and prove reviewers did their work
- Audit vendors and restrict system access
- Keep an incident log and review policies annually
- Build a campaign file that shows what was sent, to whom, when, by whom, and under which approval
Measure Growth Without Creating Compliance Risk
Select balanced pipeline and compliance metrics
Track pipeline quality and compliance risk side by side:
- Qualified appointments, show rates, and client-profile fit
- Response quality and results by source
- Opt-out rates, complaints, and failed disclosures
- Review exceptions
Message volume alone says little.
For reference, TopLead reports financial-services cost per appointment of roughly $300 to $350 and a 3 to 6 month campaign lifecycle. Those are one provider's figures, not industry benchmarks.
Substantiate performance claims before publishing them
If you publish "we booked 40 meetings last quarter" or compare your results to others, calculate consistently, keep the records, and review for missing context. SEC staff FAQs say gross and net performance must use the same methodology and time period.
Create stop, review, and remediation thresholds
Define in advance when a campaign pauses:
- Rising complaint volume
- Inaccurate or unapproved language
- Missing records
- Poor-quality data
- Vendor failure to honor suppression requests
Frequently Asked Questions
Are RIAs regulated by the SEC?
Some are. Depending on assets and circumstances, a firm registers with the SEC or with state regulators, and SEC-registered firms may also have state notice filings. Confirm your status with official sources and counsel.
What does RIA compliance mean?
It means following applicable registration, fiduciary, marketing, disclosure, supervision, recordkeeping, privacy, and communications requirements. Exact obligations vary by firm and jurisdiction.
What is the difference between a CFP and an RIA?
CFP® is an individual certification from the CFP Board. An RIA is generally the registered advisory firm. One person can be a CFP® professional at an RIA, but the terms aren't interchangeable.
Can RIAs use third-party lead generation services?
Yes, after reviewing data sources, messaging, disclosures, opt-outs, contracts, security, and records. Outsourcing the activity doesn't outsource the responsibility.
What records should an RIA keep for prospecting communications?
Keep communications, approvals, disclosures, contact and opt-out records, lead sources, appointment details, complaints, and vendor activity. Follow the retention requirements in your SEC, state, and communications policies.
