SEC Marketing Rule: What It Means for Your Adviser Website

Marketing · By ·

Stone office buildings and American flags along Wall Street in New York City, seen from street level.

The SEC marketing rule (Rule 206(4)-1 under the Investment Advisers Act) governs every advertisement an SEC-registered investment adviser (RIA) puts out. Every enforcement case listed below involved the firm’s website.

In short, for an adviser website:

  • Any page that offers your advisory services is likely an advertisement.
  • Client reviews are testimonials or endorsements, with required disclosures.
  • Ranking badges need dates and sources.
  • Performance needs net figures beside gross.
  • Model or backtested returns need written policies and disclosures before they go on a public page.
  • You keep a copy of each advertisement you put out, which in our reading means each version of a page as published.

This post walks through an adviser’s website section by section, using the SEC’s own documents and its enforcement actions so far. It is for the CEO, CMO or chief compliance officer who owns RIA marketing and is planning a site rebuild. It is not legal advice; your compliance officer or counsel should sign off on how any of this applies to your firm.

The rule in brief

The rule applies to any adviser “registered or required to be registered” with the SEC under section 203 of the Advisers Act. It replaced the old advertising and cash solicitation rules with one rule, adopted on December 22, 2020. Firms had until November 4, 2022 to comply, and any advertisement disseminated on or after that date is subject to it.

An advertisement has two prongs. The first is a communication to more than one person that offers your advisory services to prospective clients or private fund investors, or offers new services to current ones. The second is any testimonial or endorsement you pay for, whatever the audience. Live, unscripted oral remarks and required regulatory filings are excluded.

The rule text has not been amended since April 2022. The staff’s FAQ page was last updated on January 15, 2026. The FAQs say of themselves that they “have no legal force or effect,” though they do show how the staff reads the rule.

Which pages on your website count as advertisements

The adopting release says that content which “offers or promotes the adviser’s services on an adviser’s own website or social media page would likely meet the definition.” Whether a given page qualifies “depends on the facts and circumstances,” and the release carves out general education about investing, such as explainers on asset classes, investment vehicles or strategies.

We would sort a typical adviser site along these lines before anyone writes copy, then check each row with compliance.

PageWorking assumption
Home, services, who we serve, pricingAdvertisement.
Team biosCan be an advertisement when they offer or promote the firm’s services. Watch credentials and awards, and any “seen on” line.
Insights articles on markets or asset classesCan fall outside the definition if purely educational. A call to action to hire you makes that part of the page an advertisement. A performance chart is a separate question for compliance.
Reviews page or review widgetTestimonials or endorsements. Disclosure rules apply.
Awards and as-featured-in stripThird-party ratings, or claims that need substantiation.
Strategy or model portfolio pages with returnsPerformance advertising. Hypothetical performance rules may apply.
Retirement or goal calculatorsPossibly outside the hypothetical performance rules as an interactive tool, if its conditions are met. The page can still be an advertisement.

Every page is also subject to the general prohibitions. Two of them come up repeatedly in the cases below. A material statement of fact needs a reasonable basis for believing you can substantiate it on demand. And any benefit you describe needs “fair and balanced treatment” of the material risks and limitations that come with it.

Reviews, testimonials and review widgets

Under the SEC marketing rule, testimonials come from current clients. A statement from anyone else is an endorsement, though the release says a former client describing recent prior experience can be treated as a testimonial. Either one shown on your site needs clear and prominent disclosure of whether the person is a current client, whether they were compensated, and any material conflicts.

The adopting release says these disclosures “must be at least as prominent as the testimonial or endorsement” and must “be included within the testimonial or endorsement.” The staff reads that as ruling out hyperlinked disclosures.

Much of the exam staff’s December 2025 risk alert covers choices a web team makes. The most common problem it found was disclosures missing at the moment the testimonial was shown, often on advisers’ websites, “including websites using alternative business names” of their supervised persons. Staff also saw:

  • hyperlinked disclosures instead of disclosures inside the testimonial;
  • disclosures in a smaller or lighter font than the review they belonged to;
  • reviews pulled from third-party sites onto the adviser’s own site without saying they came from current or former clients;
  • gift cards given to clients for writing reviews on third-party websites.

As we read it, the third item covers an embedded review widget. Each review pulled in from Google or another platform needs the client-status disclosure next to it. Disclosure text can use the same contrast thresholds we list in our guide to accessibility and WCAG 2.2.

An example review block

This review block is our own illustration, laid out with the disclosures inside it. The name and wording are invented for this post, and your compliance officer decides the exact text.

They explained every fee before we signed, and the plan still makes sense two years later.

Dana M., current client. Dana received no compensation for this review and has no material conflicts with the firm.

Both lines sit in the same block, in the same type size and color. Where a widget shows a review from someone who is no longer a client, the second line changes to say so.

Picture an adviser site whose embedded review widget shows a star average. Before launch, the compliance officer would check whether each review’s author is a current or former client and whether anyone was paid. A widget that cannot show both inside the review needs a specification change before the build starts.

Paid reviews and referrals

Paying someone for a review makes that person a promoter, which brings extra requirements. Compensation of $1,000 or less in the preceding 12 months counts as de minimis, which relaxes some of them. The staff found advisers who paid under $1,000 each time but went over $1,000 across 12 months. The staff also lists refer-a-friend programs for current clients among the paid arrangements it saw.

Moderation and third-party content

Content written by others becomes yours in two ways, according to the release. You adopt it when you “explicitly or implicitly” endorse or approve it, and you become entangled when you involve yourself in preparing it.

Open public comments are not yours by default, as long as you don’t selectively delete or alter them or help write them. Removing profanity or spam under “pre-established, objective criteria” is allowed when those criteria are in your policies and don’t favor you. If you delete negative comments or push positive ones to the top, the release says the SEC would attribute the comments to you.

If your widget lets you filter by star rating, showing only five-star reviews looks to us like the “prioritizing the display of positive comments” the release describes. That reading is our own, and we found no SEC guidance that addresses review widgets by name, so take it to your compliance officer before you configure the widget.

Ratings, awards and logos

A third-party rating is a rating or ranking from an unrelated party that produces ratings in the ordinary course of business. To show one, you need a reasonable basis to believe the survey behind it made favorable and unfavorable answers equally easy to give. The disclosures must state the date of the rating, the period it covers, who produced it, and whether you paid anything in connection with it. Like testimonial disclosures, they must be “at least as prominent as the third-party rating.”

Staff findings in 2024 and 2025 show how website badges go wrong:

  • logos that did not clearly identify who created the rating;
  • a year range on an award that included a year the firm had not won it;
  • fees paid to be considered for a ranking, or for the logo and reprints, left undisclosed;
  • disclosures placed “at the bottom of the website pages away from the actual ratings”;
  • rankings based mainly on assets under management or staff nominations, with no note that the method was not related to the quality of investment advice.

The April 2024 alert also describes advisers putting the SEC logo on their websites to imply the SEC had approved them.

Performance, calculators and model portfolios

The performance requirements are among the most detailed in the rule. For any performance you show:

  • If you show gross performance, net performance has to appear too, with at least equal prominence, calculated over the same period with the same method.
  • Performance for a portfolio or composite (private funds are excluded) also has to cover one-, five- and ten-year periods, each with equal prominence and ending no earlier than the most recent calendar year-end.
  • If the portfolio is younger than a period, its life is shown for that period.

The FAQ says a reasonable time to calculate the figures after year-end “generally would not exceed one month.”

Hypothetical performance means results “not actually achieved by any portfolio” of the adviser. It includes model portfolios, backtests and targeted or projected returns, and the release treats all model performance as hypothetical. Before it goes on any page, you need policies and procedures reasonably designed to make it relevant to the likely financial situation and objectives of the intended audience, plus enough information about the criteria, assumptions, risks and limitations behind it.

The release also says “advisers generally would not be able to include hypothetical performance in advertisements directed to a mass audience.” In our reading, an open web page reaches a mass audience, so we would keep these figures off public pages unless compliance concludes otherwise.

A calculator where a client or prospect runs their own simulations of the likelihood of various outcomes is excluded from the definition of hypothetical performance, if the conditions in the rule are met.

If your site shows slices of a portfolio, read the March 2025 FAQ on extracted performance. Gross figures for an extract need net figures too, with a narrow staff position for extracts shown beside the total portfolio’s results. A January 2026 item covers model fees.

What the SEC has charged so far

The table below lists the marketing rule enforcement actions we found on sec.gov that involve websites. Penalties shown are each order’s total. All were settled without the firms admitting or denying the findings.

DateMatterFirmsPenaltiesWebsite conduct named by the SEC
Aug 2023Titan Global Capital Management1$850,000, plus $192,454 disgorgement and interest“annualized” hypothetical results as high as 2,700 percent for a crypto strategy
Sept 2023Nine-adviser sweep9$850,000 combinedHypothetical performance on public websites without the required policies; two firms also failed to keep required copies of their advertisements
Apr 2024Five-adviser sweep5$200,000 combinedHypothetical performance on public websites without policies
Aug 2024The Pacific Financial Group1$430,000Hypothetical performance on its public website without the required policies
Sept 2024Nine-adviser sweep9$1,240,000 combinedUnsubstantiated “conflict-free” claims, testimonials not from current clients, undated ratings
Nov 2024Wahed Invest1$250,000Hypothetical returns on its website for more than 17 months; paid athlete endorsements without disclosures
Sept 2025Meridian Financial1$75,000A website claim that it “refuse[d] all conflicts of interest”; website ads not kept

Across those seven, by our count, 27 firms agreed to pay $3,895,000 in civil penalties. Seventeen of the 27 were charged over hypothetical performance shown on a public website. Some orders also cover violations outside the marketing rule.

The SEC called Titan’s case the “first violation of the SEC’s amended marketing rule.” In the April 2024 sweep, four firms agreed to pay $20,000 to $30,000 each, and the SEC said those amounts “reflected certain corrective steps” they took before staff contacted them.

Keep every version, and keep Form ADV in step

Rule 204-2 requires a copy of each advertisement you disseminate, kept for five years from the end of the fiscal year in which it last ran, the first two in an appropriate office. You also keep the working papers behind any performance figure and the documentation for your reasonable basis on testimonials and ratings.

Meridian relied on a third party to keep copies of the advertisements on its website and did not obtain the contractual undertaking its own compliance manual required.

Make version archiving a requirement of the CMS or hosting setup, with a dated snapshot of each page whenever it changes and a written agreement with whoever stores them. If you are moving platforms, plan how the old site’s records will be kept before it goes dark. Our website migration checklist covers the move itself.

Form ADV is the other record exam staff compare your site against. Item 5.L asks whether your advertisements include performance, specific investment advice, testimonials, endorsements, third-party ratings, hypothetical or predecessor performance, and whether you pay for testimonials, endorsements or ratings.

The April 2024 alert found advisers who answered “no” on third-party ratings while their websites showed them. The release says these answers only need updating in the annual amendment, so a badge added mid-year could sit out of line with your ADV for months, on our reading of the release.

FINRA Rule 2210 for dual registrants

Dual registrants also answer to FINRA’s advertising rules, chiefly Rule 2210 on communications with the public. A retail communication is any written or electronic communication made available to more than 25 retail investors within 30 calendar days. A registered principal must approve each one before use, subject to exceptions.

For the first year after a new member’s FINRA membership takes effect, retail communications published in public media, including any generally accessible website, must be filed with FINRA at least 10 business days before first use.

A testimonial about a member’s investment advice or performance needs prominent disclosure that it may not be representative and is no guarantee of future performance or success, plus a note when more than $100 was paid for it. FINRA’s Regulatory Notice 17-18 applies the same adoption and entanglement ideas to links and third-party posts.

Rule 2210 has generally barred projecting performance, with exceptions. On October 15, 2026, the SEC approved a FINRA amendment allowing projections and targeted returns under conditions, and the SEC’s order notes it covers “a subset” of what the advisers rule treats as hypothetical performance. We could not confirm an effective date, so check FINRA’s rule-filing page before relying on it.

Marketing rule checklist for an RIA website

Use this as a starting list for your compliance officer or counsel to review.

  • Every page tagged in your page inventory as advertisement, education or exempt, and reviewed by compliance before launch.
  • Testimonial and endorsement disclosures inside each review block, at the same size and weight as the review, with no link to them.
  • Review widgets show all reviews, with no star filter unless compliance has approved one, and each review is labelled as from a current or former client.
  • Rating badges carry the date, period, rating firm and any payment, next to the badge.
  • Net beside gross, one-, five- and ten-year periods, refreshed after each calendar year-end (staff: generally within a month).
  • No model, backtested or hypothetical returns on public pages unless the policies exist, the other conditions are met and compliance has approved the page.
  • No “conflict-free” or “seen on” claims you cannot document, and no SEC logo.
  • Dated snapshots of every page kept for at least five years, with a written records agreement if a vendor stores them.
  • Form ADV Item 5.L answers checked against what the site actually shows.

If a rebuild is on the table, our software development team builds custom web applications and can scope version snapshots and disclosure components with you. Our fintech page explains how we work with regulated teams, where compliance keeps the final say on regulated decisions. You can also book a call.

Sources

, Marketing & Technology Lead, Innovara Studios. Shaya is Marketing & Technology Lead at Innovara Studios. He runs marketing, SEO and AI visibility, and the technology behind the websites and software we build. How we research and write.

Want more of our writing in your Google results? Add Innovara as a preferred source.