FINRA Rule 2210 sets the standards broker-dealers and their associated persons must meet when they communicate with the public, by email, on a website, through social media, in a chat app or by text.
The rule splits them into three categories, correspondence, retail communications and institutional communications, and the dividing line is how many retail investors see a message within 30 calendar days.
Whichever category applies, the communication has to be fair, balanced and not misleading, with a sound basis behind every claim.
Retail communications currently need a registered principal’s approval before use, some must be filed with FINRA’s Advertising Regulation Department, and all of them have to be retained under SEC Rule 17a-4 and produced on request.
What It Costs to Get Rule 2210 Wrong
Regulators now fine firms over the records alone, without needing to find anything wrong in the underlying business. In September 2022 the SEC charged 16 firms with widespread recordkeeping failures over off-channel messages that were never preserved, and those firms paid combined penalties of more than $1.1 billion.
Rule 2210 enforcement has followed the same pattern. Between January 2020 and April 2023, roughly 1,700 influencers promoted M1 Finance to the public, helping to open and fund more than 39,400 new accounts. Some of those posts weren’t fair or balanced, and some overstated what customers could expect from margin lending. M1 never reviewed or approved any of them before they went live, and never retained them afterwards.
FINRA fined the firm $850,000 in March 2024, citing Rules 2210, 2010, 3110 and 4511 alongside the Securities Exchange Act of 1934. TradeZero America paid $250,000 three months later for the same combination of failures, and Open to the Public Investing paid $350,000 in May 2025.
Each of those firms had a supervisory policy it could describe in an interview, and none of them could produce the records to show the policy had been followed.
What Rule 2210 Covers and Why FINRA Wrote It
Rule 2210 deliberately avoids listing banned phrases. It sets out principles of fair dealing and good faith instead, so the same duties hold whether a message goes out as a printed brochure, a LinkedIn post or an automated account alert.
Anything a firm or an associated person puts in front of investors falls inside the rule.
What changes from one communication to the next is the category it lands in, and that determines how much supervision it needs before it can go out.
Correspondence, Retail and Institutional Communications
Every communication falls into one of three categories, and which one depends on who receives it.
Institutional communications are defined by the type of investor on the other end, while correspondence and retail communications are separated by a headcount, 25 retail investors in any 30 calendar day period.
Correspondence
Correspondence sits at or below the 25 investor mark.
It needs no approval before use, and firms supervise and review it under Rules 3110(b) and 3110.06 through .09, which means a documented review process rather than a sign-off on every message.
Retail communications
Above 25, the same content becomes a retail communication, and the count runs across the whole 30 day window rather than per send.
Each one currently requires an appropriately qualified registered principal to approve it before the earlier of its use or its filing, and that principal usually holds a Series 24 or a Series 26 depending on the subject matter.
Retail research reports may be approved by a supervisory analyst instead.
Two types are carved out of pre-use approval and supervised like correspondence, posts on an online interactive forum and communications that make no financial or investment recommendation and don’t promote a product or service of the firm.
Institutional communications
Institutional communications go only to institutional investors such as banks, insurance companies and registered investment companies, with no headcount involved.
These need written procedures for principal review that are reasonably designed to achieve compliance, supported by training and surveillance.
The exception catches firms out regularly, because a member can’t treat a communication as institutional if it has reason to believe that the message, or any part of it, will be forwarded to a retail investor.
Filing with the Advertising Regulation Department
Filing doesn’t replace principal approval. It sits on top of it, and plenty of communications need both.
What has to be filed depends on the material, and the deadline depends on whether FINRA wants to see it before or after it reaches investors.
Filed at least 10 business days before first use:
- Everything a new member widely disseminates, for its first year of membership
- Retail communications about registered investment companies carrying self-published performance rankings or comparisons with other funds
- Communications concerning security futures
Filed within 10 business days after first use:
- Anything promoting a specific fund or family of funds
- Public direct participation programs
- Certain derivative securities
Correspondence and institutional communications are outside the filing regime altogether, as is previously filed material reused without material change. That’s not the same as being unsupervised, since FINRA runs spot checks and targeted examinations on material it never asked to see.
Content Standards and the Records That Prove Compliance
Rule 2210 has two halves that firms tend to treat separately.
One sets what a communication may say, and the other sets what a firm has to be able to show about how that communication was handled. Examiners test the second half far more often than the first.
Content standards every communication must meet
Every communication in every category has to meet the same core standards.
It must be fair and balanced, with a sound basis behind every claim it makes, and it has to reflect the principles of good faith and fair dealing that sit underneath the whole rule.
The prohibitions are more specific, covering material omissions that would mislead the reader and any claim that is false, exaggerated, unwarranted or promissory. Communications may not predict or project performance, apart from narrow exceptions such as hypothetical illustrations of mathematical principles and reports produced by qualifying investment analysis tools.
Three areas carry additional disclosure duties.
Comparisons must disclose every material difference, including cost, liquidity, safety, guarantees and tax treatment. Testimonials about investment advice or performance need three prominent disclosures, that the testimonial may not represent the experience of other customers, that it is no guarantee of future performance, and, where more than $100 in value changed hands, that it was paid for.
Firms serving retail investors also need a readily apparent reference and hyperlink to BrokerCheck on the initial page intended for retail investors and on any page carrying a registered person’s profile, and FINRA has said a footer link generally doesn’t meet that standard.
What a Rule 2210 record must contain
The recordkeeping side is more specific than most firms expect. Under Rule 2210(b)(4)(A), the record for a retail or institutional communication must include:
- A copy of the communication with the dates of first and last use
- The name of the principal who approved it and the date of approval
- The name of whoever prepared or distributed it, where there was no pre-use approval
- The source of any statistic, chart, table or illustration used
- For communications relying on the filing exception, the name of the firm that filed it together with the review letter
Those records are kept under SEC Rule 17a-4, generally for three years from last use with the first two years readily accessible.
Since the SEC’s 2022 amendments took effect in May 2023, firms can satisfy the electronic storage requirement either with a WORM system or with an audit-trail system able to recreate an original record after it has been modified or deleted.
Social Media, Influencers, and Public Appearances
Social media is where Rule 2210 meets channels the rule wasn’t written for, and where FINRA has concentrated its enforcement over the past two years. It’s also the part of the rule most likely to look different a year from now.
Where the current rules draw the line
Static content that a firm controls, such as a profile, a pinned post or an advertisement, is a retail communication and needs pre-use approval today.
Interactive real-time content in an online forum is carved out of approval and filing, though it still has to be supervised and retained.
When a firm pays a third party to promote it, the resulting post becomes the firm’s own retail communication with the firm’s approval and recordkeeping duties attached.
Unscripted public appearances follow the content standards without pre-use approval, and any script, slide deck or recording distributed afterwards becomes a communication in its own right.
What Regulatory Notice 26-14 would change
That framework is in the middle of being rebuilt.
In Regulatory Notice 26-14, published in July 2026 with comments closing on 11 September, FINRA proposed replacing the blanket pre-use approval requirement with a risk-based supervisory standard.
Firms would set written procedures deciding which retail communications need principal approval, weighing eight codified factors including who prepared the content, whether it makes a recommendation and how it is distributed.
The proposal would also remove the static and interactive distinction on the grounds that the line has blurred, and it names finfluencers and AI-generated communications as the situations the current rule handles worst.
The substantive content standards wouldn’t change.
What would change is where the burden sits, because firms adopting risk-based procedures would have to maintain evidence that those procedures were implemented and carried out, and make that evidence available to FINRA on request.
How Jatheon Supports FINRA Rule 2210 Compliance
Off-channel messages are where Rule 2210 exposure accumulates quietly, because a text or a WhatsApp thread that never reaches an archive can’t be supervised and can’t be produced.
Jatheon Data Connectors capture email, chat, social, voice, web pages and files from 25+ channels in evidentiary-quality format with full metadata, including Microsoft Teams, Slack, Zoom, Bloomberg, WhatsApp, iMessage, Android SMS, Claude AI conversations and the social accounts a firm runs on Facebook, X, Instagram and YouTube.
Influencer posts and interactive content land in the archive alongside everything else, instead of disappearing when a platform prunes them.
Volume is the second problem, since a mid-sized firm can generate more messages in a week than a compliance team can read in a month.
Jatheon’s AI Classification tags newsletters, out-of-office replies and bounce messages so reviewers can filter them out of the queue, and AI sentiment scoring places each message on a six-point scale running from very negative to very positive.
Liya, the archive’s AI assistant, answers questions across the whole archive in plain language. All three sit in Jatheon’s licensed AI module rather than shipping by default.
The third job is proving that any of it happened.
Jatheon Cloud keeps records in immutable, WORM-compliant storage with retention policies and legal hold applied at the record level, role-based access spans 85 discrete permissions, and the action log timestamps every search, export, tag assignment and account change together with the user who performed it.
Unified Search then runs one query across every archived channel at once, so a request naming a person and a date range returns email, text messages, Teams messages, WhatsApp threads, social posts, and other channels in a single result set, filterable by origin platform.
When an examiner asks how a particular communication was handled, the trail is already assembled rather than reconstructed under pressure.
