RIA social media compliance starts from one premise: under the SEC’s Marketing Rule at 17 CFR 275.206(4)-1, almost every post a registered investment adviser publishes about its services is a regulated advertisement. That means content rules, disclosure obligations, recordkeeping duties, and supervisory review all apply to LinkedIn updates, X threads, Instagram captions, and even reply comments. Firms that treat social media casually have paid hundreds of thousands of dollars for marketing violations and, in the aggregate, billions for related recordkeeping failures.
When a Social Media Post Becomes an Advertisement
The Marketing Rule defines an advertisement as any direct or indirect communication an adviser makes to more than one person that offers investment advisory services regarding securities to prospective or current clients.1U.S. Securities and Exchange Commission. Investment Adviser Marketing One-on-one communications are carved out, but that carve-out disappears the second the same message reaches a second person or sits on a public feed.2eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing
The practical result is that if a post promotes the firm’s advisory services, it is an advertisement. Treat every business-related post that way from the start.
Content Rules That Apply to Every Post
The Marketing Rule lays down seven general prohibitions. A post cannot contain an untrue statement of material fact, omit a material fact that makes what’s said misleading, or imply something misleading about the firm. It cannot include a material claim the adviser could not substantiate on demand from the SEC. And it cannot be “otherwise materially misleading,” a catch-all the SEC uses to reach anything creative that the other six categories don’t cover.3eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing
Two prohibitions cause most of the trouble on social platforms. First, you cannot talk about the potential benefits of your services without fair and balanced treatment of the associated material risks and limitations. A post celebrating strong returns with no mention of the risk profile behind them violates this rule. Second, you cannot cherry-pick specific investment advice or performance time periods in a way that isn’t fair and balanced.4U.S. Securities and Exchange Commission. SEC Adopts Modernized Marketing Rule for Investment Advisers A screenshot of one winning stock pick, with no context about the rest of the portfolio, is the kind of post that draws examiner attention.
Testimonials, Endorsements, and Paid Influencers
Testimonials used to be banned outright in adviser advertising. The Marketing Rule now permits them under strict conditions. A testimonial comes from a current client. An endorsement comes from anyone who is not a current client, including social media influencers, financial bloggers, and paid athletes.
When an adviser uses either, the ad must clearly and prominently disclose, at the time it is shared, whether the person is a current client, whether they were compensated, and any material conflicts of interest arising from the relationship.2eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing These disclosures cannot sit behind a “learn more” link. The most common deficiency SEC examiners have reported is exactly this: failure to make the required disclosures at the time of dissemination.5U.S. Securities and Exchange Commission. Additional Observations Regarding Advisers’ Compliance With the Advisers Act Marketing Rule
A de minimis exception applies when total compensation to the person for the testimonial or endorsement is $1,000 or less during the preceding 12 months. Above that threshold, the firm must have a written agreement with the promoter, oversee their activities, and reasonably believe the required disclosures are being made.3eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing Compensation to “ineligible persons” (those subject to a disqualifying SEC action or event) is off the table entirely. In November 2024, the SEC penalized one adviser $250,000 for paid athlete endorsements that lacked the required disclosures.
Performance Posts
Performance is where social media compliance most often breaks down. The Marketing Rule doesn’t prohibit performance advertising, but it imposes conditions that make casual posting risky.
If a post shows gross performance, it must also show net performance with at least equal prominence, over the same time period and using the same methodology.6Securities and Exchange Commission. Marketing Compliance – Frequently Asked Questions Bold gross returns with net returns in fine print will not survive review. Net performance is what clients actually earned after fees, and that is what regulators expect prospective clients to see first.
Hypothetical performance, including back-tested results and model portfolios, is only permitted if the adviser has adopted and implemented policies reasonably designed to ensure the hypothetical results are relevant to the likely financial situation and investment objectives of the intended audience.3eCFR. 17 CFR 275.206(4)-1 – Investment Adviser Marketing The firm must also give the audience enough information to understand the assumptions, risks, and limitations behind the numbers. Posting hypothetical returns to a public feed without those safeguards drove several 2024 enforcement actions. Time periods must be labeled clearly and cannot be chosen to manufacture a misleading impression of steady growth.
Third-Party Content: Adoption and Entanglement
An adviser can be held responsible for posts it didn’t write. The SEC applies two doctrines.
Adoption happens when the firm explicitly or implicitly endorses third-party content. Resharing a client’s glowing review, quote-posting a favorable article with approving commentary, or embedding outside content into your marketing all count. Once adopted, the content is your advertisement, with every disclosure, recordkeeping, and compliance obligation that entails.7U.S. Securities and Exchange Commission. Final Rule: Investment Adviser Marketing
Entanglement happens when the adviser is involved in preparing the third-party communication. Drafting talking points for a client’s review, or coaching an influencer on what to say, entangles you with the content no matter who posts it.
A narrow safe harbor allows limited editing of third-party posts: an adviser can remove profanity, defamatory statements, spam, or factually incorrect material without triggering adoption, provided the edits follow pre-established, documented criteria that don’t favor the adviser. Anything beyond that requires the same compliance review as original content.
Recordkeeping and Archiving
Rule 204-2, the Books and Records Rule, requires advisers to keep originals of written communications received and copies of written communications sent that relate to recommendations, advice, orders, or performance, plus copies of every advertisement disseminated.8eCFR. 17 CFR 275.204-2 – Books and Records to Be Maintained by Investment Advisers Posts, direct messages, and comments all qualify.
The retention period is at least five years from the end of the fiscal year in which the last entry was made, with the first two years kept in an appropriate office. For advertisements, the five-year clock runs from the end of the fiscal year in which the adviser last disseminated the communication. Electronic records must accurately reflect the original, stay accessible to anyone entitled to view them, and be reproducible in a legible format including printouts.
Every version matters. Edits, deletions, and changes between draft and final all need to be captured. If employees use personal devices for business, those communications must be archived the same way. Disappearing-message features and encrypted platforms that block archiving for business discussions create exactly the gaps that turn into enforcement actions.
Off-Channel Communications
The most expensive compliance failure in the advisory industry right now is not misleading marketing. It is the use of unapproved channels (text messages, WhatsApp, Signal, personal email) for business conversations that should sit in firm records.
Since 2022, the SEC has brought 95 enforcement actions and imposed $2.3 billion in penalties against firms for failing to maintain and preserve off-channel communications.9U.S. Securities and Exchange Commission. SEC Announces Enforcement Results for Fiscal Year 2025 In January 2025 alone, 12 firms settled charges with civil penalties ranging from $600,000 to $12 million per firm.10U.S. Securities and Exchange Commission. Twelve Firms to Pay More Than $63 Million Combined to Settle SEC’s Charges for Recordkeeping Failures Orders in these cases have repeatedly noted that supervisors responsible for enforcing communications policies were among the worst offenders.
The lesson is straightforward. A policy that says “don’t text clients on your personal phone” is not enough. The firm needs systems that actually capture communications wherever they occur, and it bears responsibility for failing to supervise employees who use unapproved channels.
Supervision, the CCO, and Employee Personal Accounts
Every SEC-registered adviser must designate a Chief Compliance Officer to administer the firm’s compliance policies and procedures.11eCFR. 17 CFR 275.206(4)-7 – Compliance Procedures and Practices In practice, the CCO is the gatekeeper for social media: reviewing content, enforcing the compliance manual, and making sure digital activity matches the Marketing Rule.
Supervision extends to employee personal accounts when those accounts touch the firm’s advisory business. A financial adviser posting investment commentary from a personal LinkedIn profile is still communicating on behalf of the firm if the content promotes the firm’s services. Most firms route employee drafts through a compliance portal, where a reviewer approves or rejects before publication.
The SEC judges compliance programs by whether they were “reasonably designed” to catch problems, not whether they exist on paper. A firm with a written social media policy but no pre-review, no archiving, and no training can face a failure-to-supervise charge even when no individual post is misleading. A September 2025 enforcement action produced a $75,000 penalty for an adviser whose failures included no annual compliance review and inadequate advertisement recordkeeping.
What a Written Social Media Policy Needs to Cover
A written policy is not optional. It should identify approved platforms, list every authorized user and permitted account handle, and specify the pre-approval workflow for content. A standard disclosure block belongs in the bio or “about” section of each profile, including the firm’s legal name, registration status, and a link to full disclosures.
Archiving deserves its own attention. Pick a vendor whose software can capture posts, comments, direct messages, and metadata in a form that meets Rule 204-2’s retention and reproducibility rules. These tools typically connect through platform APIs. When a connection breaks (usually after a password change), it needs to be reestablished immediately, because the gap in between is the kind of gap examiners find.
Areas firms routinely overlook:
- Employee departures. Revoke access to firm accounts and change shared credentials the same day someone leaves.
- Third-party interactions. Give staff clear guidance on when they can share, like, or comment on posts mentioning the firm, and explain how adoption and entanglement apply to those interactions.
- Off-channel communications. Prohibit unapproved messaging platforms for client and prospect communication, and back the prohibition with technical controls that capture communications even when someone breaks the rule.
- Training. Annual sessions at minimum, plus additional training when rules change or new platforms come into use.
State-Registered Advisers Face Different Testimonial Rules
Not every adviser registers with the SEC. Smaller firms typically register with a state securities regulator, and state rules for advertising do not always match the Marketing Rule. The most important divergence involves testimonials: some states still explicitly prohibit client testimonials in adviser advertising, while others follow the SEC’s approach and permit them under the same conditions.
For a state-registered firm operating in more than one state, the effect is usually that the strictest state’s rules control, because geographic targeting on social media is imprecise. Before building any strategy around testimonials or endorsements, a state-registered adviser needs to check each state’s position.
Cybersecurity Ties Back to Compliance
A compromised social media account can be a regulatory event, not just a public relations one. Amended Regulation S-P requires registered investment advisers to adopt written incident response programs addressing unauthorized access to or use of customer information, including timely notification procedures for affected individuals.12Securities and Exchange Commission. Regulation S-P: Privacy of Consumer Financial Information and Safeguarding Customer Information The compliance date for smaller entities is June 3, 2026.13FINRA. SEC Regulation S-P Compliance Date Approaching for Some Entities
Depending on what an attacker accesses, a hacked adviser profile can trigger those obligations. At a minimum, an RIA social media policy should require multi-factor authentication on all business accounts, documented procedures for revoking access when an employee leaves, and a protocol for responding to unauthorized activity. These controls sit at the intersection of IT hygiene and regulatory duty.