FINRA-Compliant Cold Email: A Plain-English Guide for Advisors

Which rules apply depends on who is sending

Start by working out which hat the sender is wearing. A registered representative of a FINRA member broker-dealer is covered by FINRA's communications and supervision rules [1][2] and by the SEC's broker-dealer record-keeping rule [4]. An investment adviser representative of a registered investment adviser (RIA) is covered by the SEC's marketing rule [6] and the adviser record-keeping rule [5]. Dual registrants can be covered by both, depending on what the email offers.

Everyone sending commercial email in the U.S. also has to follow the CAN-SPAM Act [7]. State securities rules, your firm's own written procedures and, if you write to people abroad, local privacy and marketing laws can add more. The UK and EU are generally stricter about unsolicited email to individuals than the U.S.

Correspondence or retail communication: the 25-in-30-days test

FINRA Rule 2210 sorts written communications by audience. Correspondence is any written or electronic communication "distributed or made available to 25 or fewer retail investors within any 30 calendar-day period." A retail communication is the same thing sent to more than 25 retail investors in that window [1]. A retail investor is anyone who isn't an institutional investor, whether or not they have an account with the firm.

The category decides who has to look at the message and when. An appropriately qualified registered principal must approve each retail communication before it is used, with some exceptions, such as communications that don't recommend anything or promote a product or service [1]. Correspondence doesn't need pre-approval under Rule 2210. It must be reviewed under the firm's supervisory procedures instead.

A prospecting campaign is rarely 25 emails. If substantially the same pitch goes to more than 25 retail prospects within 30 days, plan on treating it as a retail communication even when names and opening lines change from one recipient to the next. Where exactly that line falls for heavily personalized email is a judgment for your compliance team, so ask them before launch rather than after.

Every message must be fair and balanced

Rule 2210's content standards apply to every category. Communications "must be fair and balanced" and must give "a sound basis for evaluating the facts," and a firm may not leave out a material fact or qualification if that would make the message misleading [1]. In practice that rules out promises of returns, risk-free language, cherry-picked performance and anything you couldn't back up if asked.

Short cold emails help here. A message that introduces the rep, gives a specific reason for writing and asks one question has very little in it that can go wrong. Long emails full of claims about performance or products are the ones that need careful review.

Supervision: the firm has to review, and prove it did

FINRA Rule 3110(b)(4) requires procedures for reviewing incoming and outgoing correspondence relating to the firm's securities business [2]. Firms may take a risk-based approach and decide how much correspondence needs review beyond the subjects the rule names. If not everything is reviewed before it goes out, the procedures must include training staff on the firm's correspondence rules and documenting that training.

The review must leave evidence. Supplementary Material .07 says it must "clearly identify the reviewer, the internal communication or correspondence that was reviewed, the date of review, and the actions taken," and adds that "merely opening a communication is not sufficient review" [2]. A supervisor can delegate parts of the work but remains responsible for it.

Investment advisers: prospecting email is often an advertisement

For RIAs, the SEC marketing rule defines an advertisement as any direct or indirect communication "to more than one person" that offers the adviser's advisory services to prospective clients, among other things [6]. A campaign sent to a list of prospects usually meets that description. A genuinely individual note to one person usually doesn't, unless it includes hypothetical performance.

Advertisements must not include untrue or misleading statements, must not include material statements of fact the adviser can't substantiate on request, and must give fair and balanced treatment of material risks and limitations when they mention benefits [6]. Testimonials, endorsements and performance figures each carry extra conditions. The safest prospecting email offers a conversation, not results.

Keep the record, every time

Broker-dealers must preserve "originals of all communications received and copies of all communications sent (and any approvals thereof)" relating to the business, for at least three years, the first two in an easily accessible place [4]. FINRA Rule 4511 ties member firms' books and records to the same SEC framework [3].

Investment advisers must keep copies of written communications relating to advice and recommendations, along with their advertisements, for at least five years from the end of the fiscal year of the last entry, the first two years in an appropriate office [5]. Electronic records are allowed under conditions in each rule.

The weak point is usually the outreach tool, not the archive. If a sequencer sends from a system your archive never sees, or a BCC to the archive is left off one campaign, messages leave with no copy kept. Make sure every path that can send email on the firm's behalf, including follow-ups, replies, test sends and anything triggered by an API or an AI agent, is captured.

CAN-SPAM applies on top

The CAN-SPAM Act applies to commercial email whoever sends it [7]. Headers and subject lines must not be deceptive. The message must identify itself as an ad where that applies, include a valid physical postal address, and explain how to opt out. Opt-out requests must be honored within 10 business days, and you remain responsible for vendors who send on your behalf.

For a firm with several reps, the practical problem is scope. An unsubscribe that one rep records has to stop every other rep's sequence too, or the firm keeps emailing someone who asked it to stop.

AI-written email doesn't change the rules, it changes the review

FINRA Regulatory Notice 24-09 reminds firms that its rules are technology-neutral and apply when they use generative AI just as they do with any other tool [8]. An email drafted by an AI model is the firm's communication, held to the same content, approval, supervision and record-keeping standards as one a rep typed.

What AI changes is the unit of review. When every email is written for one recipient, approving the template no longer tells you what each prospect received. The practical answer is to review the messages that will actually be sent, before they send, and to keep the exact message as the record.

• Decide whether the sender is a registered rep, an investment adviser representative or both.
• Count retail recipients per 30 days and agree with compliance whether the campaign is correspondence or a retail communication.
• Get principal approval before use where the rule requires it, and keep evidence of review either way.
• Strip out performance claims, promises and anything you couldn't substantiate on request.
• Capture every sent and received message in the firm's archive, including follow-ups, replies and test sends.
• Include a postal address and a working opt-out, and apply opt-outs across the whole firm within 10 business days.
• If AI writes the emails, review the actual messages before they send, not just the prompt or template.