Home › Blog › Is Cold Email Legal for Financial Services? UK, EU, US and Canada
Cold email to finance firms: PECR, UK GDPR, Germany's UWG, CAN-SPAM, CASL and when FSMA s21 or FINRA apply. Quoted from the primary sources.
By Moe Alhosni · Published 29 October 2026 · 10 min read
Short answer: Yes, in most cases, if the email goes to a business, sells a business product, and follows the email rules of the country you send into. The UK allows cold email to companies and LLPs but not to sole traders without consent. The US allows it under CAN-SPAM's opt-out rules. Canada needs implied or express consent. Germany needs prior consent for email advertising, even B2B. Finance-specific rules (FSMA s21, FINRA 2210, the SEC Marketing Rule) bite when the sender is promoting investments or advisory services, not when it sells software or services to a bank.
This is general information, not legal advice; check with your compliance team or counsel.
I'm Moe Alhosni, founder of ROI Maximizer. We run B2B cold email campaigns and are paid per qualified meeting that took place. Before this I spent four years and seven months in sales at Moody's in London, finishing as Assistant Director, Sales, covering central banks, financial institutions, asset managers, PE and VC. Earlier, at BLOM Bank France in London, part of my job was customer due diligence and AML/KYC record updates.
Below are the rules, quoted from the primary sources, with links so you can check every line. We have not run a finance campaign yet; this page is about the law, not our results. The full picture of how we work with finance firms is on the financial services hub.
Most of the confusion about cold email in finance comes from mixing up two different sets of rules.
My reading of the texts below: selling a B2B product to a finance firm (software, data, compliance services, outsourced operations) is ordinary B2B marketing. It engages the first set only. The second set comes in when the email itself invites someone to invest, or offers advisory services with regard to securities. A fund emailing allocators, a wealth manager emailing prospects, an RIA's templated outreach: those carry both sets. Have your counsel confirm where your own campaign sits.
The consent rule for marketing email is regulation 22 of PECR. Its scope is narrow. It "applies to the transmission of unsolicited communications by means of electronic mail to individual subscribers." For those individuals, you need prior consent unless the soft opt-in applies: details obtained "in the course of the sale or negotiations for the sale of a product or service", marketing of "similar products and services only", and a simple way to refuse at collection and in every message.
Who is an individual? Regulation 2 defines "individual" as "a living individual and includes an unincorporated body of such individuals". A "corporate subscriber" includes a company, "a partnership in Scotland", and "any other body corporate or entity which is a legal person distinct from its members".
The ICO's guidance on email marketing puts it plainly: "You can email or text any corporate body (a company, Scottish partnership, limited liability partnership or government body)." And: "Sole traders and some partnerships are treated as individuals."
What this means for a finance list:
PECR governs the message. UK GDPR governs the personal data in your list, because jane.smith@bank.co.uk identifies Jane. The ICO notes you "may also need to consider data protection implications if you are emailing employees at a corporate body".
The usual lawful basis is legitimate interests, Article 6(1)(f) UK GDPR. Since the Data (Use and Access) Act 2025, Article 6(11)(a) lists "processing that is necessary for the purposes of direct marketing" as an example of processing that may be a legitimate interest. That is an example, not a free pass. The ICO's legitimate interests guidance sets out the purpose, necessity and balancing tests, and says you "must be able to satisfy all three parts of the test before you start using the information."
The right to object is absolute. Under Article 21(3), once someone objects to direct marketing, "the personal data shall no longer be processed for such purposes." In practice: one "please stop" from anyone at that address, and they go on your suppression list for good.
The Data (Use and Access) Act 2025, Schedule 13, applies the Data Protection Act 2018 penalty regime to PECR. It points section 157(2) at PECR regulations including 22 and 23, and those carry "the higher maximum amount": for an undertaking, "£17,500,000 or 4% of the undertaking's total annual worldwide turnover" in the preceding financial year, whichever is higher. SI 2026/82 brought Schedule 13 into force on 5 February 2026, for breaches on or after that date. A sloppy list is now a board-level risk.
Recital 47 of the GDPR says: "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." Many vendors stop there and call EU B2B email "fine on legitimate interest".
That is wrong for at least one big market. The GDPR covers the data. Each member state's ePrivacy law covers the message, and they differ. Germany's Act against Unfair Competition (UWG), section 7, treats advertising by "electronic mail without the addressee's prior express consent" as an unacceptable nuisance. Unlike the phone rule in the same section, the email rule does not draw a line between consumers and businesses. The only exception, in section 7(3), is for existing customers whose address you got through a sale.
So: before you email a Frankfurt asset manager, get a view on German law from someone qualified in it. For the rest of the EU, check the national rule in each country you send into. I would not run an EU-wide finance campaign on one legal assumption.
The FTC's CAN-SPAM compliance guide is short and blunt: "The law makes no exception for business-to-business email." It is an opt-out regime, not an opt-in one. Cold B2B email is lawful if each message meets the rules:
The FTC states that each email in violation "is subject to penalties of up to $53,088". That figure is inflation-adjusted, so check the page for the current one.
If you are a fintech selling to US banks, CAN-SPAM is usually the main email rule. If you are a broker-dealer, FINRA Rule 2210 also applies to your prospecting emails. If you are an SEC-registered investment adviser, the Marketing Rule treats a templated email to more than one prospect as an advertisement. Both are covered in FINRA 2210 and the SEC Marketing Rule for prospecting emails.
Canada is the strictest of the four for cold email. CASL section 6(1) prohibits sending a commercial electronic message unless the recipient "has consented to receiving it, whether the consent is express or implied". Section 6(2) requires the message to identify the sender, give contact details, and include an unsubscribe mechanism.
The B2B route is implied consent under section 10(9)(b). The recipient must have "conspicuously published, or has caused to be conspicuously published" the address, with no statement refusing unsolicited messages, "and the message is relevant to the person's business, role, functions or duties in a business or official capacity". Section 10(9)(c) gives the same route where the person disclosed the address to you directly.
In practice, an address from a data vendor is not automatically "conspicuously published". Check where each Canadian address was published, keep a record, and make sure the message fits the person's role.
FSMA section 21 says a person "must not, in the course of business, communicate an invitation or inducement to" engage in investment activity, unless they are authorised or the content is approved by an authorised person with the right permission. Breach is a criminal offence under section 25.
A fintech emailing a bank about its payments platform is not inviting anyone to invest. A fund manager emailing a pension scheme about a new fund is. Email is a "non-real time" communication under article 7 of the Financial Promotion Order, which matters for which exemptions you can use. The investment-professional exemption in article 19 is the one most institutional campaigns rely on. All of that is in when a cold email becomes a financial promotion.
| Market | Cold B2B email to a company address | Main condition | Primary source |
|---|---|---|---|
| UK | Allowed to corporate subscribers | Identify yourself, valid opt-out address, legitimate interests for the data; sole traders and some partnerships need consent | PECR reg 22, ICO |
| Germany | Needs prior express consent | No B2B carve-out for email advertising | UWG s7 |
| Other EU | Depends on the country | GDPR legitimate interests plus the national ePrivacy rule | Recital 47 plus national law |
| US | Allowed (opt-out regime) | CAN-SPAM content rules; FINRA or SEC rules if you are a broker-dealer or RIA | FTC guide, FINRA 2210 |
| Canada | Only with implied or express consent | Conspicuous publication plus relevance to the role | CASL s6, s10(9) |
| UK firm promoting investments | Restricted | Authorised, approved, or an exemption such as art 19 | FSMA s21 |
When I sold into banks, the vendor's answers on data and process mattered as much as the product. If a bank's compliance team asks how you found them, have a named data source and collection date, a written legitimate interests assessment, a one-step opt-out that is honoured at once, a real sender and postal address, and an email that plainly does not promote an investment.
What we do on every campaign: work addresses at corporate bodies only, sole traders and individual subscribers filtered out in the UK, Canadian addresses checked against the publication test, an opt-out in every email, and any objection treated as permanent. We do not run retail investment promotions, consumer credit campaigns or fundraising to unvetted individuals. The UK detail is also in B2B lead generation agencies in the UK.
If an agency will send cold email on your behalf into finance, ask for these in writing:
Then look at what you pay if nothing happens. With us, it is a setup of $1,000–$3,000, then $200–$500 per qualified meeting that took place, or a flat $5,000/month. No minimum term, and nothing for a no-show. The detail is in pay-per-meeting pricing.
If you want to talk through whether your finance campaign is a plain B2B campaign or a financial promotion, book 30 minutes or email moe@roimaxi.com. I will tell you if it is one we should not run.
Moe Alhosni, founder, ROI Maximizer (M Ventures LTD, 4 Beau Street, Bath BA1 1QY).
About the author: Moe Alhosni, founder of ROI Maximizer. Before that he spent four and a half years in sales at Moody's in London, most recently as Assistant Director, Sales, working with banks, asset managers and private equity firms. He runs the campaigns behind the first-hand data on this site. LinkedIn
Or run the free GTM teardown on your own site for the ICP, cold email and numbers specific to your company.
ROI Maximizer is a trading name of M Ventures LTD, registered in England and Wales, company no. 15554493. Registered office: 4 Beau Street, Bath BA1 1QY, United Kingdom. moe@roimaxi.com
© 2024–2026 M Ventures LTD. Privacy notice