The FINRA Rule 2210 Sign-Off and Review Model

No page ranking for the broad regulated-content term gives a real FINRA workflow, which is exactly why it is worth doing properly. This is the US broker-dealer sign-off model, step by step, and it sits within the wider system mapped in our guide to content marketing in regulated industries.

The standard caution applies throughout. This explains how Rule 2210 works so you can understand and design around it. It does not tell you whether a specific piece of your content is a retail communication or which standard applies to it, because those are regulated judgements that depend on your facts and your firm’s status. Ridley Digital is not a FINRA registered principal or a law firm. For your own content, those calls belong with a qualified principal or legal counsel.

Step 0: which category is your content in?

Everything in Rule 2210 follows from the category, so this is where you start. There are three. A retail communication is any written or electronic communication distributed or made available to more than 25 retail investors within any 30 calendar-day period. Correspondence is the same kind of communication to 25 or fewer retail investors in 30 days. An institutional communication is one directed only to institutional investors. A retail investor, in FINRA’s definition, is any person other than an institutional investor, whether or not they have an account with the firm.

The category matters because it sets the approval rule, and there is a trap built into it. A piece you intend as institutional becomes retail-regulated the moment the firm has reason to believe a retail investor will see it. So content cannot be classified by your intention alone; it is classified by who can actually access it. Which category a specific piece falls into is a judgement for a qualified person at your firm, not something to settle from a general description.

Step 1: principal pre-approval for retail

For retail communications the core requirement is direct: an appropriately qualified registered principal of the firm must approve each one before the earlier of its use or filing with FINRA’s Advertising Regulation Department. Approval comes before publication, not after. And “appropriately qualified” is doing real work in that sentence, because the principal’s registration has to match the product; a principal qualified for one product type is not automatically qualified to approve communications about another.

What counts as a retail communication is broader than most marketers assume, and this is where firms get caught. It is not just brochures and email blasts. Websites, social posts, pitch decks, email newsletters, webinar invitations and paid ads can all be retail communications when they reach more than 25 retail investors in 30 days. Even a sales script used in a seminar with more than 25 retail investors is a retail communication that the firm must approve before use. The breadth is the point: if it reaches the public and promotes the firm’s business, assume it is in scope until a principal confirms otherwise.

Step 2: filing, especially in Year 1

New member firms carry an extra obligation in their first year. During that period, they generally have to file retail communications with FINRA’s Advertising Regulation Department at least 10 business days before first use. This is a pre-filing requirement, a window the regulator gets to review the content before it goes live, and it applies on top of, not instead of, principal pre-approval.

Two things firms get wrong here. First, the volume of pre-filing typically drops after Year 1, but the content standards and the recordkeeping do not relax, so a filing workflow built only to survive Year 1 and then dismantled leaves the firm exposed. Second, certain content types carry filing obligations beyond the Year 1 window regardless. Build the filing workflow to last rather than as a temporary first-year chore.

Step 3: the content standards

Whatever the category, the content standards under Rule 2210 set the bar for what the communication can say. Communications have to be fair, balanced and not misleading, and must provide a sound basis for evaluating the product or service. They cannot include false, exaggerated, unwarranted, promissory or misleading statements. Comparisons have to be fair and complete enough to be meaningful. Risks have to be disclosed clearly, not buried beneath the benefits.

These standards map directly onto the content marketing reaches for. A performance figure needs a sound basis and a documented source. A claim about outcomes cannot be promissory, implying a result the firm cannot guarantee. A comparison against a competitor has to be balanced rather than selectively flattering. The 850,000 dollar influencer case turned in part on posts that were not fair or balanced and made exaggerated or promissory claims, which is these standards being applied to social content made on the firm’s behalf.

Step 4: recordkeeping that survives an exam

The records are part of the obligation, not an afterthought, and they tie to the SEC’s recordkeeping framework and FINRA’s own Rule 4511. Communications and their approvals are generally kept for at least three years, with the first two years readily accessible, in a format that cannot be altered after the fact. The record is not just a copy of the content. It includes the dates of first and last use, the name and title of the registered principal who approved it, and the source of any statistics, tables, charts or performance data the communication relied on.

One practical failure worth naming: a screenshot does not reliably capture interactive, dynamic or social content as the public actually experienced it, and content that changed over time or by user behaviour needs a capture method that reflects what was really seen. The depth of the recordkeeping and capture question is its own subject, covered in our guide to the compliance evidence trail. The point here is that the record has defined contents and a defined retention, and missing either can fail an examination even when the content was sound.

Step 5: the modern-channel traps

The places firms get caught are the newer channels, where the speed and informality of the medium collide with the rule. FINRA’s advertising guidance makes clear that the standards do not relax just because a channel is fast. Social media is the obvious tension: pre-approval before use sits awkwardly against the publish-instantly culture of social, and the answer is a workflow that approves fast rather than one that skips approval.

Influencer content is retail communication, and the firm is liable for it; the 850,000 dollar case made that explicit, with the firm responsible for posts it had not reviewed or retained. AI-generated content is the firm’s responsibility regardless of the tool that produced it, so using a generator does not move the obligation onto the software. And there is a distinction between live, unscripted public appearances and distributed materials such as slides, which carry the fuller approval and record obligations. Each of these is a place where the medium tempts a shortcut that the rule does not allow.

The cross-border note

If you also market in the UK, note that FINRA and the FCA are different regimes with different thresholds, different approvers and different records. Clearing content under Rule 2210 does nothing for your UK obligations, and the reverse is equally true. Operate in both and you run both workflows. The UK equivalent is set out in our guide to the FCA financial-promotion approval workflow.

FAQs

What is FINRA Rule 2210?

FINRA Rule 2210 governs how broker-dealers communicate with the public. It divides communications into three categories, retail, correspondence and institutional, and sets approval, content and recordkeeping requirements for each. Its core principle is that communications must be fair, balanced and not misleading, and its core mechanic is that retail communications need approval by a qualified registered principal before use. The rule applies to essentially all forms of public communication, from a website to a social post to a paid ad, which is why it reaches far more marketing content than firms often expect.

What counts as a retail communication?

A retail communication is any written or electronic communication distributed or made available to more than 25 retail investors within any 30 calendar-day period. A retail investor is any person other than an institutional investor, whether or not they have an account with the firm. The category is broad in practice: websites, social posts, pitch decks, email newsletters, webinar invites, paid ads and even seminar sales scripts can be retail communications. Importantly, content intended as institutional becomes retail-regulated if the firm has reason to believe a retail investor will see it, so access, not intention, decides.

Who has to approve broker-dealer marketing?

An appropriately qualified registered principal of the firm must approve each retail communication before the earlier of its use or filing with FINRA. “Appropriately qualified” matters: the principal’s registration has to match the product the communication concerns, so a principal qualified for one product type is not automatically able to approve communications about another. The approval is a pre-publication requirement, not a review after the fact. Whether a given individual is appropriately qualified to approve specific content is a matter for the firm and its compliance function rather than a general guide.

How long must FINRA communications be retained?

Communications and their approval records are generally retained for at least three years, with the first two years readily accessible, in a non-alterable format, tying to the SEC’s recordkeeping rules and FINRA Rule 4511. The record is more than a copy of the content: it includes the dates of first and last use, the name and title of the approving registered principal, and the source of any statistics or performance data used. Missing or incomplete records can cause an examination to fail even where the content itself met every content standard.

Is a firm liable for influencer or AI-generated content?

Generally yes. Influencer content made on a firm’s behalf is treated as retail communication, and the firm is responsible for it, as the 850,000 dollar enforcement case made explicit, where the firm was liable for posts it had not reviewed or retained. AI-generated content is likewise the firm’s responsibility regardless of the tool that produced it. Using a third party or a piece of software does not transfer the obligation. Exactly how this applies to a specific arrangement is a regulated judgement to take advice on rather than assume.

Last reviewed: June 2026

This article is general information about FINRA Rule 2210 and is not legal, compliance or regulatory advice. Ridley Digital is not a FINRA registered principal or a law firm. Whether a communication is retail, correspondence or institutional, and how the rule applies, depends on the facts; take advice from a qualified registered principal or lawyer before relying on this.