The most popular advice on federal and state regulatory compliance is also among the riskiest: build one national template, get it approved, and use it everywhere. That approach confuses a common federal baseline with a single set of rules for every firm, representative, campaign, and audience.
A website may promote an SEC-registered adviser while also featuring a representative whose state registration obligations depend on where that person works and solicits clients. A social post may count as an advertisement, a broker-dealer retail communication, or both. The practical answer isn't a longer disclaimer. It's a documented decision system that identifies which rules apply to each person and each campaign, then preserves the evidence behind every claim.
Table of Contents
- Why One Compliance Template Is Not Enough
- The Two Compliance Layers Explained Simply
- State-by-State Variation and Where It Bites
- Federal Enforcement and State Enforcement in Parallel
- A Working Review Workflow for Multi-State Campaigns
- Testimonials, Endorsements, and the Performance Claim Checklist
- What a Real Enforcement Case Teaches Marketers
- Your 90-Day Compliance-First Marketing Rollout
Why One Compliance Template Is Not Enough
A uniform template looks tidy. It can also conceal the most important question: who is communicating what, to whom, and in which jurisdiction? Federal registration status doesn't make state oversight disappear, and SEC review doesn't automatically settle whether a representative's conduct meets state requirements.
NASAA says state securities regulators oversee advisers with $100 million or less in assets under management and all investment adviser representatives, including representatives of SEC-registered firms. The same social post can therefore sit within a firm's federal marketing program and raise a separate question about an individual representative's solicitation activity or disclosures. Treating the firm's registration status as the only compliance input misses that distinction.
Practical rule: Standardize the process. Vary the content and review where the facts or jurisdiction require it.
A working compliance matrix should connect four things: the campaign, the people involved, the jurisdictions targeted, and the claims being made. It should identify which rules apply, who must approve the material, what evidence supports its claims, and where the final version and approvals will be retained. That's more useful than a universal disclaimer because it tells the firm what to do when a campaign crosses state lines or changes audience.
This guide focuses on how to build that system. It covers the federal baseline, state registration and representative-level exposure, parallel enforcement, and a review workflow that gives marketing, compliance, and operations clear responsibilities. It also addresses a weakness generic advice often skips: even polished trust language needs evidence that matches the firm's actual practices.
For a multi-state advisory firm, the sensible goal isn't identical copy everywhere. It's consistent governance, with documented variation when jurisdiction, personnel, or campaign details call for it.
The Two Compliance Layers Explained Simply
A federal approval does not clear every state obligation. The federal layer governs applicable advertising, broker-dealer communications, and information-security requirements. The state layer addresses adviser and representative registration, state securities laws, and jurisdiction-specific supervision. Treat each as a separate decision about the campaign and the people behind it.
What the federal layer covers
The SEC's Marketing Rule consolidated earlier advertising and cash-solicitation provisions. It permits testimonials, endorsements, third-party ratings, and performance advertising subject to applicable disclosure, oversight, and anti-misleading requirements. Related books-and-records and Form ADV amendments support documentation and reporting. Permission to use a format is only the starting point: keep evidence supporting the claims within it. (SEC guide to the Investment Adviser Marketing Rule)
For broker-dealer affiliates, FINRA Rule 2210 adds its own communications requirements, including qualified registered-principal approval of retail communications, subject to the rule's exceptions. Newly admitted members also face advance-filing requirements for covered retail communications during their initial membership period. Identify whether the asset is an adviser advertisement, a broker-dealer communication, or both before assigning approval responsibility. (FINRA Rule 2210)
The FTC Safeguards Rule concerns customer information rather than advertising claims. Covered financial institutions under FTC jurisdiction must maintain a written information-security program with administrative, technical, and physical safeguards. That includes risk assessment, service-provider oversight, and adjustments as conditions change. Check applicability before treating this rule as a requirement for every advisory firm. (FTC Safeguards Rule guide)
What the state layer adds
State review starts with the firm's registration basis and the individual representative's obligations. NASAA's guidance distinguishes firm registration from representative registration and describes requirements involving place of business, jurisdiction-specific client-count tests, Form U4, fees, qualifications or examinations, and background checks. A firm-level registration determination therefore leaves a separate personnel question to resolve. (NASAA investment adviser FAQs)
Assign that question to a named reviewer.
Consider a website testimonial paired with a lead form. Review the testimonial's disclosures and oversight, check the soliciting representative's state obligations, and assess information-security requirements if the form collects customer information. Keep the testimonial's supporting evidence with the approved asset. An approval record should explain which requirements apply and why, rather than merely record that someone approved the page.
State-by-State Variation and Where It Bites
A campaign can cross a state line before the firm's registration does. That is why a state-by-state review must connect registration status, personnel, solicitation, campaign audiences, and required records. The firm's registration basis sets one part of the picture; a representative's location and activity can create separate obligations.
Consider a representative with a place of business in two states. First, determine whether the representative must register in each state based on the applicable place-of-business and client-count rules. Then check the firm's registration and filings in those jurisdictions. If the representative solicits clients in a third state, assess that activity separately rather than treating the representative's existing registrations as a nationwide permission. The governing tests depend on the states involved, so record the basis for each decision and confirm the current state requirements.
| Variable | SEC-registered firm | State-registered firm | Representative |
|---|---|---|---|
| Registration scope | Federal registration, plus applicable state requirements | State registration in relevant jurisdictions | Generally tied to place of business, with some state-specific client-count tests |
| Campaign reach | Map the states reached and apply federal review plus state overlays | Check each relevant state's requirements before launch | Identify solicitation, offering, negotiation, or sale of advisory services |
| Records and disclosures | Maintain firm-level policies, records, and required disclosures | Track applicable state filings and supervisory expectations | Link activity and registration status to the firm's records |
| Escalation trigger | New geography, audience, claim, or promoter | State-specific restriction or unresolved registration question | New location, client activity, or campaign role |
Track the work, not just the registrations
Build a state-by-state matrix covering personnel, business locations, solicitation activity, applicable client counts, Form ADV disclosures, filings, and renewal dates. Add a campaign identifier and the states it targets. When a marketer or recruiter solicits, offers, negotiates, or sells advisory services, route that person's role for registration review. Do not assume the question applies only to portfolio managers.
Treat advertising as a jurisdictional decision, too. A claim approved under the firm's federal review may still need a state-specific disclosure or additional review because of a representative's activity. Keep that state analysis in the campaign approval record, alongside the claim's supporting evidence. A bare approval checkbox will not explain why the asset was cleared for those audiences.
For campaign-planning context, this guide to getting legal clients via Facebook can help teams understand how a channel reaches a defined audience. The adviser must still map each campaign to the representatives, jurisdictions, and substantiation records that govern it.
Federal Enforcement and State Enforcement in Parallel
Federal and state oversight aren't competing routes where only one regulator matters. They're parallel systems with different scopes, and a firm should plan for both. The SEC's marketing framework reaches adviser advertising, while state securities regulators investigate and bring actions under state laws, including registration and anti-fraud provisions.
The 2025 NASAA Enforcement Report, based on responses from regulators in 49 U.S. states and territories and covering 2024 activity, recorded 8,833 investigations and 1,183 enforcement actions. Those actions involved 1,514 individuals and entities and included 145 criminal actions, 69 civil actions, and 853 administrative actions. (2025 NASAA Enforcement Report)
The reported mix makes a practical point: a control program shouldn't focus only on headline-grabbing litigation. Administrative proceedings made up roughly 72% of reported state enforcement actions, so ordinary examination readiness, documentation, and representative supervision deserve serious attention. State regulators can examine firms and people whose conduct reaches their jurisdiction, including through digital marketing.
The SEC enforcement pattern also matters for marketing operations. Recent matters have involved unsupported performance claims, inadequate net-performance presentation, hypothetical performance without required policies, website recordkeeping, and misleading conflict statements. A firm that can explain its federal approval process but cannot show which state obligations applied to the people involved has an incomplete defense.
For a broader perspective on consumer-protection concerns that can accompany state-level business conduct, Florida firms may find this resource on FDUTPA protection for startups useful. It doesn't replace securities-law analysis, but it underscores why firms shouldn't treat compliance as a single-regulator exercise.
A practical allocation rule is straightforward: route adviser advertising and performance claims through the federal marketing review; route representative registration and state-specific conduct through the state matrix; and escalate any campaign that touches both. Firms seeking a concise overview of the federal side can also consult this explanation of SEC compliance.
A Working Review Workflow for Multi-State Campaigns
A workflow only works when each handoff has an owner and produces an artifact. Marketing shouldn't decide registration scope alone, and compliance shouldn't be asked to reconstruct the campaign after it has gone live.
Intake, owned by the campaign lead. Collect the full asset set, intended audience, channels, target states, launch timing, people featured, and any paid or referral relationships. The artifact is a campaign intake record. Incomplete geography or promoter information is a reason to pause, not a detail to fill in after publication.
Registration scoping, owned by compliance or registration operations. Match the campaign's personnel and solicitation activity to the jurisdictional matrix. Record the states reviewed, the registration basis, and any unresolved question. Marketing approval isn't a substitute for this step.
Claim substantiation, owned by the claim owner with compliance review. Attach evidence for each material statement, including performance data, descriptions of services, testimonials, and claims about conflicts. Record how the evidence supports the exact wording and who verified it. If a claim can't be substantiated, revise or remove it.
Approval and filing, owned by the appropriate principal or compliance approver. Record the final copy, reviewer, approval date, and any state-specific changes. For FINRA-member firms, check whether Rule 2210 approval and filing apply. Newly admitted members have the one-year filing window and the advance-filing requirement described above, so the membership-effective date belongs in the routing checklist.
Archive and monitor, owned by compliance operations. Preserve the approved version, supporting evidence, approvals, and publication record. Recheck the live asset when facts change, a disclosure becomes stale, or a campaign is repurposed. A useful social-campaign planning resource is this Scheduler.social social campaign guide, but publication planning doesn't replace compliance approval.
For testimonials and endorsements, the Marketing Rule requires prominent disclosures about whether the promoter is a client and whether the promoter is compensated, along with required compensation and conflict information. A written agreement is generally required, except for an affiliate or a promoter receiving de minimis compensation of $1,000 or less, or equivalent noncash compensation, during the preceding 12 months. The campaign file should show which condition applies and retain the relevant agreement or exception rationale. (SEC release on the Marketing Rule)
Testimonials, Endorsements, and the Performance Claim Checklist
Treat every marketing claim as an asset with an owner, evidence, approval, and review date. That discipline catches the problem generic “legal review” misses: a statement may sound reasonable but still lack support or omit context that changes its meaning.
Build the file around the claim
For testimonials and endorsements, record the promoter's client status, compensation, material relationships, relevant conflicts, and whether a written agreement is required. Confirm that the disclosures appear prominently in the actual format being used, not merely in a separate policy file. If the compensation exception applies, preserve the facts supporting that conclusion.
Performance claims need their own evidence trail. Keep the data, calculation method, applicable time periods, and required gross and net presentation together with the approved copy. Hypothetical performance requires particular care because policies and procedures must address its use. Third-party ratings should be reviewed for their basis and required disclosures rather than treated as neutral decorations.
Broad statements about trust or conflicts need evidence too. A claim such as “conflict-free” can be harder to support than a carefully qualified description of how the firm identifies and manages conflicts. Match each statement against disclosures and documented practices, then remove language that overstates what the firm can demonstrate.
A disclaimer can explain a claim. It can't create evidence for one.
A weekly review should compare live assets against the approved version, confirm that cited evidence remains current, and flag changes in people, compensation, services, or disclosures. For broker-dealer communications, include the required principal approval and any applicable filing record. Firms developing client stories can use this guide on how to create case studies as a content-planning reference, then apply the same substantiation and approval process used for other claims.
The point isn't to make every campaign slow. It's to make the evidence easy to retrieve and the review repeatable. When the claim file travels with the asset, compliance can distinguish a supported statement from attractive copy that has outlived its facts.
What a Real Enforcement Case Teaches Marketers
A polished claim can create more risk than blunt marketing language when it overstates how a firm operates. In September 2025, the SEC announced a settled case involving an adviser that claimed it “refuse[d] all conflicts of interest.” The matter included website recordkeeping and annual-review deficiencies and resulted in a $75,000 civil penalty. (SEC enforcement review by Sidley)
The lesson isn't that firms should avoid describing their conflict practices. It's that absolute language invites a direct comparison between the marketing claim, the firm's disclosures, and its actual procedures. If the firm can't reconcile those records, the statement's reassuring tone won't fix the gap.
Make the claim auditable after publication
For every broad trust or conflict statement, keep a substantiation file that identifies the evidence, reviewer, approval date, and related disclosures. Archive each web version with a timestamp so the firm can show what visitors could see, rather than relying on the current page to represent past content.
Tie the review to the business calendar. Annual reviews should include a check that published claims still match the firm's conflicts, services, and supervisory practices. Repurposed or AI-generated content should receive the same review as human-written material; a new format doesn't make an old claim current.
A usable audit cadence is simple: review live high-risk claims on a recurring schedule, investigate material changes promptly, and document the decision to retain, revise, or remove each statement. The file should show both what the firm said and why it believed the claim was accurate when published.
Your 90-Day Compliance-First Marketing Rollout
Weeks one and two: Build the state and personnel matrix; inventory live campaigns and assign owners.
Weeks three and four: Create a claim taxonomy, evidence files, and written-procedure updates.
Weeks five through eight: Launch intake, routing, approval, archiving, and applicable filing checks.
Weeks nine through twelve: Train staff, run an audit dry run, and document recurring monitoring.
Each milestone should end with a named owner and a retained artifact. Start with the live assets that combine broad claims, testimonials, performance language, or multi-state targeting.
Advisor Momentum provides compliance-ready websites, content, and marketing workflows for financial advisers and banking teams, with attention to state-specific requirements and approval records. If the firm is rebuilding its campaign review process or planning growth across states, visit Advisor Momentum to explore its services.
