SEC Marketing Rule and Your Website: A Compliance Check
Your website is not just a marketing tool. Under the SEC Marketing Rule, it is a live compliance surface that regulators can review at any time.
If you are a Registered Investment Advisor, broker-dealer, or financial advisor, every page on your site that promotes your services, displays client feedback, or references investment performance may qualify as an advertisement under Rule 206(4)-1. That means your website needs to meet the same standards the SEC applies to any other piece of marketing material you produce.
The gap between what firms think is compliant and what examiners actually flag during reviews is often wider than expected. Testimonials without proper disclosures, performance claims that omit net returns, hypothetical results shown to the general public, and outdated policies all recur in SEC risk alerts.
These are not edge cases. They are the most common deficiencies of the Division of
Examinations continue to be observed years after the rule took effect.
This guide walks through how the Marketing Rule applies to your website in practical terms. You will learn what counts as an advertisement, where examiners look first, how to handle testimonials and performance data, what disclosures need to look like, and how to build recordkeeping and governance processes that hold up during an exam.
If you want a head start on identifying gaps in your digital compliance posture, Secure Wealth IT offers a free compliance readiness assessment at (704) 769-3663 to help financial firms across the Southeast evaluate their standing.
Key Takeaways:
Your website content, including testimonials, performance claims, and social proof, likely qualifies as an advertisement under Rule 206(4)-1 and must meet all seven general prohibitions.
Disclosures must be clear, prominent, and placed where visitors actually see them, not buried in footnotes or linked pages that most people never open.
Recordkeeping, approval workflows, and ongoing monitoring are not optional extras; they are core requirements that examiners verify during every Marketing Rule exam.
What Website Content Counts as an Advertisement
The Marketing Rule uses a two-prong definition of "advertisement" that captures far more website content than many firms realize. Understanding which pages and elements fall within scope is the first step toward meaningful compliance.
The Definition of Advertisement Under Rule 206(4)-1
Rule 206(4)-1 defines an advertisement through two separate prongs. The first prong covers any communication by an investment adviser that offers or promotes advisory services, or that seeks to obtain or retain clients or investors.
The second prong covers testimonials, endorsements, and any communication about the adviser by a compensated person. As noted in the SEC Marketing Rule overview from Smarsh, this broad definition replaced the old advertising rule and the cash solicitation rule with a single, unified framework.
Your website almost certainly falls within this definition if it describes your services, highlights outcomes, or features client feedback.
First-Prong Website Communications
Under the first prong, most of your website pages qualify as advertisements. Your homepage, services pages, "about us" section, blog posts that reference your advisory capabilities, and landing pages designed to generate leads all promote your business.
Even a seemingly neutral educational article can cross the line if it includes calls to action or references to your specific investment approach.
The key question is whether the communication offers, promotes, or seeks to obtain or retain clients. If the answer is yes, the Marketing Rule applies.
Second-Prong Testimonials and Paid Promotions
The second prong captures content involving compensation. If you pay someone to refer clients to your firm, feature a compensated endorsement on your site, or share paid testimonials, that content is an advertisement regardless of how you label it.
This includes arrangements previously governed by the old cash solicitation rule, which is now folded into the Marketing Rule.
What Usually Falls Outside the Rule
Certain communications typically do not count as advertisements. These include:
Live, real-time oral communications (not scripted presentations)
Responses to unsolicited requests from existing clients or investors
Certain communications required by law
A static FAQ page that only answers regulatory questions without promoting services may also fall outside the scope. When in doubt, treat the content as an advertisement and apply the appropriate safeguards.
The Website Red Flags Examiners Notice First
SEC examiners have a clear playbook when reviewing adviser websites. The seven general prohibitions under the Marketing Rule set the baseline, and the most common deficiencies involve misleading statements, unsubstantiated claims, and one-sided presentations of results.
Misleading Statements and Missing Context
Examiners look for statements that could mislead a reasonable investor. This includes claims like "we never lose money," vague promises of guaranteed returns, or language suggesting risk-free outcomes.
Even technically accurate statements can be misleading if they omit material context. For example, saying "our portfolios returned 15% last year" without disclosing the benchmark, time period, or market conditions is a red flag.
Substantiated Claims and Proof Standards
If you make a factual claim on your website, you must be able to prove it. The Marketing The rule prohibits claims that cannot be substantiated.
Statements like "top-rated advisor" or "best in class" require documented, verifiable support. As SEC risk alerts have emphasized, examiners will ask for the evidence behind these claims during an exam.
If you cannot produce it, you have a violation.
Fair Presentation of Benefits, Risks, and Limitations
You cannot highlight potential gains without giving similar prominence to potential losses and limitations. This applies to everything from a service description to a case study.
If your landing page lists five benefits and zero risks, examiners will notice. The presentation must be balanced and fair.
How the Seven General Prohibitions Apply Online
The seven general prohibitions apply to every advertisement, including your website. In summary, you cannot:
Include untrue statements of material fact.
Make unsubstantiated material claims.
Include untrue or misleading implications.
Discuss benefits without fair mention of risks or limitations.
Misleadingly reference specific investment advice.
Include or exclude performance in a way that is not fair and balanced.
Be materially misleading in any other way.
Every page on your site should be reviewed against these prohibitions.
Testimonials, Endorsements, and Third-Party Ratings on Web Pages
Using client feedback and industry ratings on your website is now permitted under the Marketing Rule, but only with proper disclosures, oversight, and documentation.
This area has been a consistent focus of SEC examinations, with recurring deficiencies identified in multiple risk alerts.
Testimonials and Endorsements on Landing Pages and Review Sites
A testimonial is a statement by a current client or private fund investor about their experience with your firm. An endorsement is a statement by someone who is not a current client that indicates approval or support for your advisory services.
Both are allowed on your website, but each triggers specific disclosure and oversight requirements. If you feature Google reviews, client quotes on landing pages, or video testimonials, all of these count.
The same applies if you encourage clients to post reviews on third-party platforms and then link to those reviews from your site.
Disclosures for Testimonials and Compensation
Every testimonial or endorsement on your site must include clear disclosures:
Whether the person giving the testimonial is a current client
Whether they received compensation (cash, reduced fees, or other benefits)
Any material conflicts of interest
A brief description of any limitations on the testimonial
These disclosures cannot be hidden in a footer no one reads. They must appear near the testimonial itself.
Third-Party Ratings and Methodology Transparency
If you display a rating from a third party, such as a Barron's ranking or a similar industry award, you must disclose:
The date of the rating.
The time period it covers.
Who issued the rating?
Any compensation paid to obtain or use it.
As noted in a review by DWT, firms should review their websites at least annually to make sure third-party ratings remain compliant and current.
Bad Actors, Oversight, and Written Agreement Issues
You cannot use a testimonial or endorsement from a person who is a "bad actor" under SEC rules. You must also maintain a written agreement with any compensated promoter, and you must have a reasonable basis for believing the person is complying with the agreement.
The SEC's December 2025 risk alert highlighted that firms continue to fail on these oversight requirements, including missing written agreements and insufficient due diligence on promoters.
Performance Claims Require Extra Care
Publishing performance data on your website is one of the highest-risk areas under the Marketing Rule.
The requirements are specific, and examiners scrutinize performance pages closely.
Getting any element wrong can result in enforcement action.
Gross and Net Performance Requirements
If you show gross performance on your website, you must show net performance alongside it with at least equal prominence.
Net performance must reflect the deduction of actual fees and expenses, or a model fee that is no lower than the highest fee charged to the relevant audience.
You cannot bury net performance in a footnote while featuring gross returns in a large font on the page.
The visual weight matters.
The SEC released updated FAQs in March 2025 that provided additional clarity on when advisers may present gross performance of extracted performance without an accompanying net figure, particularly for private fund contexts.
If you manage private funds, review these FAQs carefully.
Performance Time Periods and Fair Balance
When you present time-period performance, you must include returns for one-year, five-year, and 10-year periods, each ending on a date within the most recent period.
If the portfolio has not existed for the full period, show performance since inception.
Cherry-picking favorable time periods while ignoring unfavorable ones violates the fair balance requirement.
If a strategy had strong returns over three years but poor returns over five, showing only the three-year figure would raise questions.
Extracted, Related, and Predecessor Performance
Extracted performance refers to the results of a subset of investments from a portfolio.
Related performance shows results from related portfolios with similar strategies.
Predecessor performance involves results achieved at a prior firm.
Each category has its own disclosure requirements.
Extracted performance, for example, must be accompanied by the total portfolio results or clearly state that it does not reflect the entire portfolio.
As Kirkland & Ellis noted, recent SEC guidance has relaxed some requirements around extracted performance, but the core principles of fair presentation remain.
Performance Presentations on Public Pages
Any performance data visible on a public-facing page is accessible to all visitors, including people who may not have the sophistication to evaluate it properly.
This creates additional risk, especially for hypothetical or model performance, which is covered in the next section.
For actual performance data, make sure your disclosures are complete, your time periods are balanced, and your net figures are truly prominent.
Hypothetical, Model, and Backtested Results Online
Hypothetical performance is one of the most enforcement-prone areas of the Marketing Rule.
The SEC has already charged multiple advisers specifically for advertising hypothetical performance on their websites without the required policies and procedures.
If you display this type of data online, you need to approach it with extreme caution.
Why Public Website Use Is High Risk
The Marketing Rule requires that hypothetical performance be shown only to audiences for whom it is relevant based on their financial situation and investment objectives.
A public website is, by definition, available to anyone.
This makes it very difficult to satisfy the audience-suitability requirement.
Placing hypothetical results behind a gated page with qualification questions can help, but only if the gating mechanism is meaningful, not a checkbox anyone can click through.
Model Performance and Audience Suitability
Model performance, which represents what a portfolio would have returned using a specific strategy, is a type of hypothetical performance.
If you present model portfolios on your website, you must adopt policies ensuring the information reaches only appropriate audiences.
You must also disclose the criteria and assumptions used to generate the model.
Backtested Data and Assumption Disclosures
Backtested performance applies a strategy to historical data to show what would have happened.
It is inherently speculative.
You must disclose:
The results are backtested and do not reflect actual trading.
The assumptions and methodology used.
The limitations of backtested data include that past conditions may not repeat themselves.
These disclosures must be clear and prominent, not buried at the bottom of the page.
Advertising Hypothetical Performance Without Misleading Visitors
To use hypothetical performance compliantly, you must, at a minimum:
Adopt written policies and procedures specific to hypothetical performance.
Ensure the performance is relevant to the intended audience.
Provide all criteria and assumptions used in calculating the results.
Include clear and prominent disclosures about the risks and limitations.
If your firm cannot satisfy these requirements for a public-facing page, the safest option is to remove the content or restrict access to qualified prospects only.
Required Disclosures Must Be Clear, Prominent, and Consistent
Disclosures are not a technicality to check off a list.
Where you place them, how you word them, and whether they are visually prominent all affect how examiners evaluate your compliance posture.
The SEC has made it clear that a disclosure that exists but is not noticeable does not satisfy the rule.
Website Disclosures Versus Footnotes and Linked Pages
A common mistake is placing all disclosures on a single linked page or in fine-print footnotes at the bottom of the site.
While a centralized disclosure page has value, it is not a substitute for placing relevant disclosures near the claims they address.
If a testimonial appears on your homepage, the required disclosure should appear there too, not three clicks away.
Fee Explanations, Material Conflicts, and Limitations
When you mention fees, you must explain them clearly.
If your performance data reflects a model fee, state the rate and why it was used.
If there are material conflicts of interest (for example, a paid endorsement), disclose them explicitly.
Limitations matter too.
If your strategy works best in certain market conditions, say so near the performance data.
How Disclosure Placement Affects Interpretation
The SEC evaluates disclosures based on how a reasonable investor would interpret the full page, not just the disclosure text in isolation.
A glowing testimonial in bold at the top of the page paired with a tiny disclosure in gray text at the bottom is not compliant, even if all the required language is present.
Visual hierarchy matters.
Disclosures must be given at least equal prominence to the claims they qualify.
Keeping Website Messaging Consistent Across Channels
Your website, social media accounts, email campaigns, and printed materials should all tell the same story.
If your website says one thing about your approach and your LinkedIn posts say something different, that inconsistency creates regulatory risk.
Conduct regular cross-channel reviews to make sure your messaging and disclosures align.
Recordkeeping Is Part of Website Compliance
Website compliance is not just about what appears on your site today.
The SEC also requires you to maintain detailed records of your advertisements, including historical versions of your website.
Without proper recordkeeping, you cannot demonstrate compliance during an exam, regardless of how clean your current site looks.
Rule 204-2 and the Books and Records Rule
Under SEC Rule 204-2, also known as the Books and Records Rule, investment advisers must retain copies of all advertisements and marketing communications for at least five years.
This includes every version of your website that functions as an advertisement.
The rule also requires records of who approved each advertisement and the basis for that approval.
What to Archive From Pages, Forms, and Social Content
You should archive:
All public-facing website pages, including landing pages, service pages, and blog posts.
Contact forms, lead capture pages, and thank-you pages.
Social media posts, including those linked from your website.
Embedded content such as videos, podcasts, or third-party widgets.
Automated, time-stamped website archiving tools make this process far more reliable than manual screenshots.
Records must be stored in a tamper-resistant, quickly retrievable format.
Approval Workflows and Version Control
Every piece of content that qualifies as an advertisement should go through a documented approval process before it goes live.
This includes new pages, edits to existing content, and any changes to testimonials or performance data.
Maintain a log that shows who reviewed the content, when it was approved, and what changes were made.
Version control is essential.
If a page changes six times over a year, you need records of all six versions.
Why Evidence Matters During Exams and Enforcement
During an exam, the SEC will ask for your advertising records.
If you cannot produce archived copies of your website along with approval documentation, you face potential violations of both the Marketing Rule and the Books and Records Rule.
As ACA Global has noted, the SEC actively enforces both rules together.
Firms like Secure Wealth IT, which specialize in supporting financial firms with compliance-aligned IT environments, can help ensure your archiving, access controls, and documentation processes are exam-ready.
Governance, Policies, and Internal Review Workflows
Strong governance turns compliance from a reactive scramble into a routine process.
The Marketing Rule requires advisers to adopt and implement written policies and procedures reasonably designed to prevent violations.
That means your internal workflows need to cover who creates content, who reviews it, and how issues get escalated.
Building a Practical Marketing Policy
Your marketing policy should address every type of advertisement your firm produces, including website content, social posts, email campaigns, and printed materials.
It should spell out:
What qualifies as an advertisement at your firm?
Who is responsible for reviewing and approving each type?
How performance data and testimonials are vetted before publication.
How often is the policy itself reviewed and updated?
A detailed, tailored policy is far more useful than a generic template that does not reflect your actual marketing practices.
Compliance Review Roles Across Marketing, Legal, and IT
Compliance should not sit with one person alone.
Define clear roles for your Chief Compliance Officer, marketing team, legal counsel, and IT staff.
Marketing drafts the content.
Compliance reviews it against the rule.
Legal handles ambiguous situations.
IT ensures the approved version is what actually goes live on the site and that proper records are maintained.
Vendor Oversight for Web Developers and Agencies
If a third-party agency or web developer manages your website, your firm remains responsible for everything published.
Your marketing policy should include vendor oversight requirements, such as requiring advance review of all content changes and maintaining written agreements that outline compliance expectations.
An outside agency will not know the Marketing Rule unless you teach them.
Training Teams to Spot Website Compliance Issues
Regular training helps everyone involved in marketing understand the basics of what the rule requires.
Phishing simulations and cybersecurity training, which firms like Secure Wealth IT provide as part of their compliance-aligned services, are useful complements, but marketing-specific training is equally important.
Teach your team to recognize common issues: missing disclosures, unsubstantiated claims, and unapproved content changes.
How Form ADV and Public Marketing Need to Align
Your Form ADV is a public document that describes your advisory business, fees, conflicts, and practices.
Your website should reflect the same information consistently and accurately.
When examiners compare your ADV to your live website and find gaps, it raises immediate concerns.
Common Gaps Between Disclosures and Live Website Copy
One of the most frequent issues is a website that describes services, fees, or strategies differently than the corresponding Form ADV disclosures.
For example, if your ADV states you charge a 1% management fee but your website references "competitive fees" without specifics, that inconsistency could be flagged.
Review your website copy against your ADV brochure and brochure supplements at least annually.
Reporting Marketing Practices Accurately
Form ADV Part 1A requires advisers to report certain marketing practices, including whether they use performance data, testimonials, or endorsements.
If your website features these elements, your ADV must reflect that.
Failing to update your ADV after adding testimonials to your website is an easily avoidable mistake.
Keeping Solicitation and Referral Practices Consistent
The Marketing Rule absorbed the old cash solicitation rule.
If you have paid referral arrangements, your ADV should describe them, and your website should not contradict those descriptions.
For example, if your website features an endorsement but your ADV does not disclose the underlying referral arrangement, that is a gap examiners will notice.
Periodic Reviews After Website Updates
Any time your website undergoes significant changes, schedule a review to verify that your Form ADV still aligns.
This includes redesigns, new service pages, updated testimonials, or changes to your fee structure.
A standing quarterly review, which many compliance-focused IT partners facilitate, is a practical way to catch discrepancies before examiners do.
A Practical Website Compliance Review Process
Compliance is not a one-time project.
It is an ongoing discipline that requires periodic reviews, clear documentation, and a willingness to escalate issues when they arise.
Page-by-Page Review Priorities
Start with the pages that carry the highest risk:
Homepage - often contains testimonials, performance summaries, and broad claims
Services and strategy pages - usually describe your investment approach and may include performance references
Testimonial or reviews pages - require full disclosure compliance.
Blog and resource pages - may contain performance data or promotional language.
Landing pages and forms - often overlooked but frequently function as advertisements
A Compliance Checklist for Common Website Elements
Use a checklist like this for every page review:
Element | Check |
Testimonials | Disclosures present, visible, and complete |
Performance data | Net shown alongside gross with equal prominence |
Third-party ratings | Date, period, source, and compensation disclosed |
Hypothetical performance | Gated access, policies adopted, assumptions disclosed |
Fee references | Consistent with Form ADV and actual practices |
Claims | Substantiated with documentation on file |
Disclosures | Clear, prominent, and near the relevant content |
This type of compliance checklist should be part of your standard operating procedures.
When to Escalate Content for Legal or Compliance Review
Not every website edit needs legal sign-off, but certain changes should always be escalated:
Adding or changing performance data.
Publishing new testimonials or endorsements.
Making claims about rankings, awards, or industry recognition.
Launching new landing pages with lead generation forms.
Changing fee descriptions or service scope language.
When in doubt, escalate.
The cost of a compliance review is far lower than the cost of an enforcement action.
Ongoing Monitoring, Testing, and Documentation
Set a regular cadence for website compliance reviews. Quarterly is a good baseline for most firms.
Between reviews, monitor for unauthorized changes. Your IT team should have access controls in place so that only approved personnel can edit the site.
Document every review, including what was checked, what was found, and what actions were taken. This documentation becomes critical evidence during an SEC exam.
Your website is a living document. Treat it with the same care and rigor you apply to every other aspect of your compliance program.
Next Steps for Your RIA or Broker-Dealer Firm
Secure Wealth IT helps Registered Investment Advisors, broker-dealers, and financial advisors stay secure, compliant, and audit-ready. Explore these free tools and resources:
Free Financial Calculators: calculator.securewealthit.com
Compliance Self-Assessment Tool: regulations.securewealthit.com
Resource Library: Browse free RIA and broker-dealer guides
Watch on YouTube: Secure Wealth IT YouTube channel
Talk to a Specialist: Schedule a free consultation
For more information about this topic, visit us at https://www.securewealthit.com.
Comments