FINRA 2210 and the SEC Marketing Rule for Prospecting Emails: A Plain-English Guide

Home › Blog › FINRA 2210 and the SEC Marketing Rule for Prospecting Emails: A Plain-English Guide

Prospecting emails under FINRA 2210 and the SEC Marketing Rule: correspondence vs retail vs institutional, and when a template is an advertisement.

By Moe Alhosni · Published 29 October 2026 · 9 min read

Short answer: If you are a US broker-dealer, FINRA Rule 2210 sorts your prospecting emails by audience. Emails to institutions only are institutional communications. Emails to 25 or fewer retail investors in 30 days are correspondence. Anything to more than 25 retail investors in 30 days is a retail communication and needs a principal's approval before use. If you are an SEC-registered investment adviser, a templated prospecting email to more than one person is an advertisement under the Marketing Rule, even if each copy carries the recipient's name.

This is general information, not legal advice; check with your compliance team or counsel.

I'm Moe Alhosni, founder of ROI Maximizer. We run B2B cold email campaigns and get paid per qualified meeting that took place. Before that I spent four years and seven months in sales at Moody's in London, finishing as Assistant Director, Sales, covering financial institutions, asset managers, PE and VC. I have watched how carefully regulated firms treat anything that leaves the building with their name on it. US broker-dealers and advisers are no exception.

We have not run a finance campaign yet. This page is about the rules, quoted from finra.org and sec.gov with links. For the general email rules (CAN-SPAM, PECR, CASL), read is cold email legal for financial services. For how we work with finance firms, see the financial services hub.

First: does any of this apply to you?

These two rule sets apply to who you are, not to who you email.

FINRA Rule 2210 applies to FINRA member firms, which means broker-dealers.
The SEC Marketing Rule (Rule 206(4)-1 under the Investment Advisers Act) applies, per the SEC's small entity compliance guide, to advisers registered or required to be registered with the SEC that disseminate an advertisement.

If you are a fintech, a data vendor or a compliance consultancy selling to broker-dealers and RIAs, neither rule governs your email. Your email rule is CAN-SPAM. The firms you sell to will care about these rules, though, so it helps to know them; how to sell to asset managers covers that side.

If you are a dual registrant, both may apply to the same email. Your compliance team decides which framework a given campaign sits under.

FINRA Rule 2210: three kinds of written communication

FINRA Rule 2210(a) defines three categories. Every prospecting email a broker-dealer sends falls in one of them.

Category	FINRA's definition	Approval and review
Correspondence	"any written (including electronic) communication that is distributed or made available to 25 or fewer retail investors" within any 30 calendar-day period	Subject to the supervision and review requirements of Rule 3110(b)
Retail communication	"any written (including electronic) communication that is distributed or made available to more than 25 retail investors" within any 30 calendar-day period	"An appropriately qualified registered principal of the member must approve each retail communication" before use or filing
Institutional communication	"any written (including electronic) communication that is distributed or made available only to institutional investors"	Written review procedures "appropriate to its business, size, structure, and customers"

On correspondence, Rule 2210(b)(2) says: "All correspondence is subject to the supervision and review requirements of Rules 3110(b)". On records, Rule 2210(b)(4) says members "must maintain all retail communications and institutional communications" for the retention period in SEA Rule 17a-4(b).

What the 25-in-30-days line means for a cold email campaign

Cold email tools send templates to lists. Count what you send.

A template sent to 300 retail prospects over a month is a retail communication. A principal approves it before the first send.
Sending 20 personally written emails to retail prospects in a month keeps you within correspondence, but supervision still applies.
Splitting one template across several reps to stay under 25 each is the kind of arrangement I would expect a regulator to look through. Ask your compliance team before anyone tries it.

Who counts as an institutional investor

Rule 2210(a)(4) defines an institutional investor to include any "person described in Rule 4512(c), regardless of whether the person has an account with a member". FINRA Rule 4512(c) lists:

"a bank, savings and loan association, insurance company or registered investment company;"
an investment adviser registered with the SEC or a state securities commission; and
"any other person (whether a natural person, corporation, partnership, trust or otherwise)" with "total assets of at least $50 million."

There is a catch in 2210(a)(4): "No member may treat a communication as having been distributed to an institutional investor" if it has reason to believe the communication "will be forwarded or made available to any retail investor." For outbound, that means the list matters. An email to a family office's general inbox is harder to defend as institutional than one to the CIO of a $2 billion insurer.

The content standard

Whatever the category, Rule 2210(d)(1)(A) says: "All member communications must be based on principles of fair dealing and good faith, must be fair and balanced," and must give a sound basis for evaluating the facts.

For a prospecting email, that means no promissory language, no cherry-picked returns and no claims you cannot back up. A short email that asks for a meeting and says who you are clears that bar far more easily than one that pitches a product.

The SEC Marketing Rule: when a prospecting email is an advertisement

The rule's first prong defines an advertisement as "Any direct or indirect communication an investment adviser makes to more than one person" that offers the adviser's advisory services with regard to securities to prospective clients or private fund investors. That wording is in the SEC's adopting release, IA-5653. The rule excludes "extemporaneous, live, oral communications" and some regulatory notices.

One-on-one is excluded, but a mail merge is not one-on-one

The adopting release is direct about this. Bulk emails and algorithm-based messages may be "nominally directed at or 'addressed to' only one person", but "they are in fact widely disseminated to numerous investors and therefore would be subject to the final rule." And: "customizing a template presentation or mass mailing by filling in the name of an investor and/or including other basic information about the investor would not result in a one-on-one communication."

So a cold email sequence with {first_name} and {company} merge fields is an advertisement if the rest of the text is the same for everyone. A genuinely individual email to one prospect is outside the first prong.

Two further points from the release:

The one-on-one exclusion "applies regardless of whether the adviser makes the communication to a natural person with an account or multiple natural persons representing a single entity or account." Emailing three people at the same pension fund about that fund's mandate can still be one-on-one.
Duplicated inserts do not escape. Where a customised email carries a standard paragraph, "the duplicated information is an advertisement because it is sent to more than one person".

Hypothetical performance is treated more strictly. The SEC's guide says "hypothetical performance information does not qualify for this one-on-one exclusion" except in response to an unsolicited request or when given to a private fund investor.

The seven general prohibitions

Under rule paragraph (a), as set out in IA-5653, an advertisement may not:

"Include any untrue statement of a material fact", or omit a material fact needed to make a statement not misleading.
"Include a material statement of fact that the adviser does not have a reasonable basis for believing it will be able to substantiate upon demand by the Commission".
Include information likely to cause "an untrue or misleading implication or inference to be drawn".
Discuss potential benefits "without providing fair and balanced treatment of any material risks or material limitations".
Reference specific investment advice not presented "in a manner that is fair and balanced".
"Include or exclude performance results, or present performance time periods, in a manner that is not fair and balanced".
"Otherwise be materially misleading."

Point 2 is the one cold email copy breaks most often. "We help clients retire five years earlier" is a material claim. Can you substantiate it on demand? If not, it does not go in.

Testimonials and performance

The SEC's guide says advertisements "must clearly and prominently disclose whether the person giving the testimonial or endorsement" is a client and whether they are compensated, with oversight and written-agreement conditions. Gross performance is prohibited "unless the advertisement also presents net performance", among other performance conditions.

My advice for prospecting emails: leave testimonials and performance out of the cold email entirely. Their job is to earn a reply. Send material that carries the disclosures through your normal approved channels once someone asks.

The rule took effect on 4 May 2021, with a compliance date of "November 4, 2022 (eighteen months following the effective date)", per the SEC's guide.

CAN-SPAM still applies on top

Neither FINRA nor the SEC replaces the email law. The FTC's CAN-SPAM guide says "The law makes no exception for business-to-business email." Every message needs honest headers and subject lines, identification as an ad, "your valid physical postal address", a way to opt out, and opt-outs honoured "within 10 business days". If you use an agency, "Monitor what others are doing on your behalf."

Which regime applies: quick map

You are	You email	Rules that apply
Fintech or vendor	Broker-dealers or RIAs, about your product	CAN-SPAM
Broker-dealer	Banks, insurers, RIAs, $50m+ entities only	CAN-SPAM, FINRA 2210 institutional communication
Broker-dealer	More than 25 retail investors in 30 days, one template	CAN-SPAM, FINRA 2210 retail communication with principal pre-approval
SEC-registered adviser	Many prospects, one merged template	CAN-SPAM, Marketing Rule advertisement
SEC-registered adviser	One prospect, a genuinely individual email	CAN-SPAM; outside the first prong of the advertisement definition, unless it contains hypothetical performance

Prospects in the UK bring in FSMA section 21 if the email promotes investment activity; that is covered in when a cold email becomes a financial promotion.

How I would run outbound for a broker-dealer or RIA

Classify the campaign first. Institutional, correspondence, retail or advertisement. Write the classification down, and have compliance sign it.
Build the list to match. For institutional campaigns, use 4512(c) categories only and address named people in relevant roles, not shared inboxes.
Write a short, factual first email. Who you are, why this person, one specific reason to talk, a question. No returns, no testimonials, no "guaranteed".
Get every template approved before use, and keep each approved version with its date. Edits after approval go back for approval.
Route replies to licensed people. A reply asking "what are your returns?" is answered by your team under your procedures, not by an agency template.
Archive. Your email archive and your sending tool both need to meet your books-and-records obligations. Check this before the first send, not after.

The asset and wealth side of this is on lead generation for asset and wealth management.

Before you sign with anyone

If an agency will send outbound for a broker-dealer or RIA, get these in writing:

Your compliance team approves every template and every edit before it is sent. No exceptions.
Every email sent is archived where your books-and-records process can reach it.
The list rules: which categories count as institutional, and how forwarded or shared inboxes are excluded.
Who replies: the agency books meetings; your licensed staff answer anything about products, performance or advice.

We run B2B campaigns only. We will not run retail investment promotions, consumer credit or fundraising to unvetted individuals. For B2B campaigns, the terms are a setup of $1,000–$3,000, then $200–$500 per qualified meeting that took place, or a flat $5,000/month. No minimum term, nothing for a no-show. See what counts as a qualified meeting for how we define one.

If you want a second view on whether your prospecting emails are correspondence, institutional or an advertisement before your compliance team reviews them, book 30 minutes or email moe@roimaxi.com.

Moe Alhosni, founder, ROI Maximizer (M Ventures LTD, 4 Beau Street, Bath BA1 1QY).

About the author: Moe Alhosni, founder of ROI Maximizer. Before that he spent four and a half years in sales at Moody's in London, most recently as Assistant Director, Sales, working with banks, asset managers and private equity firms. He runs the campaigns behind the first-hand data on this site. LinkedIn

Keep reading

Proprietary deal flow by cold email: a setup guide for PE deal teams — How PE deal teams build proprietary deal flow by cold email: thesis-led lists, separate domains, owner signals, copy, and the UK, EU, US and Canada rules.
How Many Cold Emails per Day per Inbox? We Set 15–33, and What Gmail and Outlook Require — How many cold emails per day per inbox: the 179 inboxes we sent from on 16 Oct 2026 were set to 15–33 a day, plus what Google, Yahoo and Microsoft require.
Cold Email Templates for Agencies: 8 Real Emails From Our Own Sequences — Cold email templates for agencies, copied from two of our own 2026 sequences: the step each email sat at, its copy elements, and what I'd change.

Or run the free GTM teardown on your own site for the ICP, cold email and numbers specific to your company.

ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com