The SEC Marketing Rule: what an RIA can and cannot publish on its website

Every page of your website is an advertisement. That is not a figure of speech. Under the SEC’s amended marketing rule for investment advisers, Rule 206(4)-1 under the Advisers Act, an advertisement is broadly any communication offering advisory services to prospects, and a public website aimed at prospects is the clearest example there is.

I am not a lawyer or a compliance consultant. I build and rank advisor websites, which means I have had to read this rule closely enough to never put something on a page that your CCO will make us take down. This guide is what I wish every advisor had before they hired a web designer who had never heard of it. Everything below links to the primary source, and your compliance reviewer has the last word.

The rule in one paragraph

The SEC adopted the amended rule on December 22, 2020. It became effective May 4, 2021, and advisers had to comply by November 4, 2022. It replaced two older rules, the advertising rule from 1961 and the cash solicitation rule from 1979, with a single rule built on principles rather than a list of banned words. The full adopting release is Release IA-5653, and the SEC staff keeps a running Marketing Compliance FAQ, last updated in January 2026. The rule applies to SEC-registered advisers; state-registered advisers follow their state rules, and registered representatives of a broker-dealer follow FINRA Rule 2210.

May 4, 2021 Rule 206(4)-1 as amended became effective SEC, IA-5653

Nov 4, 2022 Compliance date; the SEC issued an exam risk alert in September 2022 saying it would begin examining immediately SEC exam risk alert

$1.24M Combined penalties in the September 2024 sweep of nine advisers, mostly over website content SEC press release 2024-121

The seven general prohibitions

The heart of the rule is a short list of things no advertisement may do. Every page on your site has to clear all seven. Paraphrasing the rule text in the adopting release, an advertisement may not:

• ✕Include an untrue statement of a material fact, or omit a fact needed to keep the statement from being misleading
• ✕Include a material statement of fact the adviser cannot substantiate on demand
• ✕Include information that would reasonably be likely to cause an untrue or misleading implication about a material fact
• ✕Discuss potential benefits without a fair and balanced treatment of material risks or limitations
• ✕Reference specific investment advice in a way that is not fair and balanced
• ✕Include or exclude performance results, or present time periods, in a way that is not fair and balanced
• ✕Otherwise be materially misleading

Notice what is on that list: “cannot substantiate.” If your homepage says “serving 400 families,” you need to be able to prove it. If it says “top-rated,” you need to be able to show the rating, its date, and who gave it. The second item alone is the reason we ask for a source behind every number on a page before we write it.

Testimonials and endorsements

This is the section that changed the most, and the one most advisor websites get wrong. The old rule banned testimonials outright. The amended rule allows them with conditions.

Two definitions matter. A testimonial is a statement by a current client about their experience with the adviser. An endorsement is a statement by someone who is not a current client that indicates approval, support, or a recommendation, and it includes paid referrals, which is why the old solicitation rule got folded in here.

To use either on your website, the rule requires disclosures that are clear and prominent:

• ✓That the testimonial was given by a current client, or that the endorsement was given by a person who is not a current client
• ✓That cash or non-cash compensation was provided, if it was
• ✓A brief statement of any material conflicts of interest on the part of the person giving it

The adopting release adds more. Compensated promoters generally need a written agreement with the adviser once compensation exceeds a small de minimis threshold, the adviser has to oversee compliance with the rule, and people subject to certain disciplinary events are disqualified from acting as promoters at all. Details, thresholds, and exceptions are in IA-5653, and the staff FAQ addresses some edge cases, including promoters subject to certain regulatory orders.

What this means for your website in practice:

Item	Fine, with disclosures	A problem
A client quote on your homepage	Labeled as a current client, compensation stated (or "no compensation"), conflicts noted, all next to the quote	The quote alone, with a first name and a city
A quote from a CPA who refers you	Labeled as a non-client, the referral arrangement disclosed	Presented as if from a client
A "what our clients say" page	Each quote with its own disclosures, records of who said what and when	A page your web designer filled from an old brochure
A paid influencer or podcast mention	Disclosed as compensated, written agreement, oversight	Treated as "just PR"

The September 2024 enforcement sweep is the clearest illustration. The SEC said some of the nine advisers published endorsements that did not disclose that the person was not a current client, or that cash compensation had been paid, and that most of the violations were found in website disclosures (SEC press release 2024-121).

Google reviews and third-party sites

“Our clients left those reviews on Google, not on our site. Does the rule even apply?”

It depends on what you did. The adopting release explains when third-party content becomes the adviser’s own advertisement: when the adviser adopts it (for example, by embedding or re-posting it) or is entangled in its preparation (for example, by soliciting it, editing it, or selecting which reviews to show). A review a client leaves on their own, that you never touch, sits differently from a review widget on your homepage or a text message campaign asking clients to post.

So the practical questions for your compliance reviewer are: Are we asking for reviews? Are we choosing which ones appear? Are we displaying them on our site? If the answer to any of those is yes, the testimonial disclosures come into play, and so does the record keeping. This is why we never ask your clients for reviews on your behalf and never add a review widget without your CCO’s sign-off. It is also why “reviews are your fuel” advice written for plumbers does not transfer to your industry.

Third-party ratings and “top advisor” badges

Rankings and badges are their own category. The rule allows third-party ratings in an advertisement only if the adviser has a reasonable basis to believe the survey behind the rating was structured so it was equally easy to give favorable or unfavorable answers, and the advertisement clearly and prominently discloses:

• ✓The date the rating was given and the period of time it is based on
• ✓The identity of the third party that created and tabulated it
• ✓Whether compensation was provided, directly or indirectly, in connection with obtaining or using the rating

In the 2024 sweep, one firm’s ratings “did not show the date on which the rating was given or the period of time upon which the rating was based,” and another misstated a published ranking (SEC press release 2024-121). If your site has a badge in the footer from a magazine list, check that the year, the criteria, and any fee you paid to use the badge are disclosed next to it. If you cannot find the criteria, the badge should come down.

Performance

Performance advertising is the most restricted part of the rule and the part a marketing website needs least. The conditions include showing net performance wherever gross is shown, using prescribed one-, five-, and ten-year periods for most portfolios, not cherry-picking results or periods, not extracting a subset of a portfolio’s results without the whole, and meeting extra conditions before using hypothetical performance. The staff FAQ has several entries on gross and net calculations, time periods, and model fees because this is where advisers keep asking.

For a website aimed at prospects, my advice is simpler than the rule: leave performance off the site. Nothing about ranking for “fee-only financial planner near me” or booking a first meeting requires a return figure, and every return figure is a compliance review, an update obligation, and a potential exam finding. We never write performance claims, projected returns, or anything with “guaranteed,” and we would rather lose a prospect who was only shopping for returns.

What you can say

After all that, it can feel like the rule leaves nothing. It does not. The pages that rank and convert are also the pages that are easiest to substantiate:

• ✓Who you serve, in specific terms: physicians, business owners, pre-retirees in your metro
• ✓How you charge, with the actual fee schedule and what it includes (your Form ADV already says it)
• ✓What "fiduciary" and "fee-only" mean, used accurately (NAPFA defines fee-only as compensated solely by the client, no commissions)
• ✓Your credentials, with links to the issuing bodies, and your registration
• ✓What the first meeting is like, step by step
• ✓Plain-English answers to the questions prospects search: "fee-only vs fee-based," "how much does a financial advisor cost," "is $500,000 enough to work with a financial advisor"
• ✓Required disclosures, your Form ADV, and your privacy policy, where a prospect can find them

Those are also the pages AI tools quote. When ChatGPT or Google’s AI Mode answers “who is a fee-only fiduciary advisor in Denver for retirement planning,” it is pulling from exactly this kind of specific, verifiable text. Hype does not help you there; precision does. See how AI search works for advisors.

A note on the NAPFA definition, because advisors misuse “fee-only” more than any other word on their sites: NAPFA requires its members to work only within the fee-only structure, “accepting no commissions for their work” (NAPFA). If your firm, or a hybrid affiliate, can earn commissions, you are fee-based, not fee-only, and a website that says otherwise is an untrue statement of material fact.

State-registered advisers and hybrid firms

Everything above describes the SEC rule, which applies to SEC-registered advisers. If your firm is registered with a state instead, your state’s rules govern. Many states have adopted language modeled on the amended SEC rule, some have kept older testimonial restrictions, and a few have their own filing or review expectations, so the only safe assumption is that your state may be stricter than the SEC. Your compliance consultant will know which it is; your web designer will not.

Hybrid firms carry two rulebooks at once. The RIA side of the business follows Rule 206(4)-1 (or the state version), and the registered representatives on the broker-dealer side follow FINRA Rule 2210, which requires an appropriately qualified registered principal to approve each retail communication before first use, and which bars statements that are “false, exaggerated, unwarranted, promissory or misleading.” In practice that usually means the firm’s website goes to the broker-dealer’s advertising review as well as the RIA’s compliance review, and the two reviewers may ask for different disclosures on the same page. Plan the timeline for both.

AI-written pages

A new wrinkle: a lot of advisor sites now carry blog posts written by an AI tool and published without a human reading them. The rule does not care who wrote the page. Every statement still has to be true, substantiated, and fair and balanced, and the adviser is still responsible. If a tool invents a statistic or implies a result, that is your advertisement. Our rule is simple: every page gets a named human author, every number gets a linked source, and every page goes to your compliance reviewer before it goes live.

Records: the part the rule makes easy if your site is built right

The amendments to the books and records rule (Rule 204-2) require advisers to keep copies of advertisements they disseminate, along with supporting documentation for things like testimonials and ratings, and the amended Form ADV asks about your marketing practices. For a website that changes every month, “keep a copy” means a dated copy of every version of every page.

Most content management systems make that hard. Pages get edited in place, old versions vanish, and when an examiner asks what your fee page said in March, nobody knows. A static website stored in git solves it by design: every change is a dated, attributed commit, every previous version is one command away, and the whole history is yours. It is the main technical reason we build advisor sites this way.

1. 1
   Name a reviewerYour CCO, your outsourced compliance consultant, or your broker-dealer principal under FINRA 2210. Put them on the schedule before the first page is written.
2. 2
   Inventory what is liveEvery page, every testimonial, every badge, every number. Note the source for each statement of fact, or remove it.
3. 3
   Fix the five usual suspectsUndisclosed testimonials, undated ratings, fee-only used loosely, performance or "guaranteed" language, and blog posts nobody read.
4. 4
   Review every new page before it is publishedIn batches, with a preview link, with changes logged. Nothing goes live without sign-off.
5. 5
   Keep the archiveDated copies of every version, with the supporting documents, where you can produce them in an exam.

The bottom line

The Marketing Rule is not a reason to have a boring website. It is a reason to have a precise one. Say who you serve, how you charge, and what working with you is like. Back every claim. Disclose every testimonial, rating, and paid referral the way the rule says. Keep the archive. Then let your reviewer do their job before the page goes live, not after an examiner finds it.

This article is general information, not legal or compliance advice. The primary sources are the adopting release, the staff FAQ, the 2022 exam risk alert, and FINRA Rule 2210. Your CCO decides.