FINRA's proposed modernization of Rule 2210 could change how broker-dealers review retail communications. The proposal would replace the current default of principal pre-use approval for each retail communication with a written, risk-based supervisory framework. Firms would decide which categories require principal approval before use, based on the product, audience, content, channel, creator and the firm's own history of concerns.
For marketing and compliance teams, the opportunity is faster handling of routine, lower-risk communications. The governance work also becomes more important. A risk-based model depends on a clear taxonomy, documented procedures, training, surveillance and evidence that the framework operates as designed.
That is a meaningful change in the shape of the work. Under a blanket pre-use approval model, the control is easy to describe: every retail communication follows the same gate and carries the name of the principal who approved it. The process may be slow or inefficient, but the evidence is relatively simple. A risk-based system gives firms more freedom to decide how communications move, and that freedom creates a different supervisory question. The firm has to show that it identified the risk correctly, sent the communication down the right route and monitored the categories that received a faster path.
The proposal has arrived as the communications estate is becoming harder to contain. A campaign is rarely one finished advertisement. It can be a landing page, a set of emails, dozens of paid-social variants, organic posts, an influencer script and AI-generated replies adapted to different audiences. Applying the same manual route to every version absorbs principal time without necessarily concentrating that attention on the communications most likely to harm an investor. FINRA's proposal recognizes that reality and asks firms to build a supervisory system around the actual risk instead.
For firms considering the change, the central task is therefore wider than deciding which content can move faster. They need to turn judgment that currently sits in experienced reviewers' heads into a documented operating model that marketing, compliance and technology can apply consistently.
What does FINRA Rule 2210 require today?
Rule 2210 divides written communications into retail communications, correspondence and institutional communications. A retail communication generally reaches more than 25 retail investors within a 30-day period. Correspondence reaches 25 or fewer retail investors in that period, while institutional communications are distributed only to institutional investors.
Under the current rule, an appropriately qualified registered principal generally approves each retail communication before its use or filing with FINRA, subject to specified exceptions. Correspondence and institutional communications sit within supervisory-review frameworks that give firms more flexibility.
The content standards apply across the categories. Communications must be fair and balanced, based on fair dealing and good faith, and provide a sound basis for evaluating the relevant security, service or facts. False, exaggerated, unwarranted, promissory or misleading claims remain prohibited.
What would Regulatory Notice 26-14 change?
The July 2026 proposal would allow a member firm to establish written procedures that determine which categories of retail communication require principal pre-use approval. Those procedures would need to reflect the firm's business, size and structure and be reasonably designed to achieve compliance with the applicable content standards.
FINRA identifies eight non-exhaustive risk factors:
- The nature and complexity of the product or service.
- The qualifications and experience of the person who prepared, endorsed or approved the content.
- Whether the communication makes a recommendation or promotes a product or service.
- Whether it promotes a product or service from an affiliate or third party.
- Whether it is tailored to a specific audience or individual.
- Whether it includes performance data, rankings or comparisons.
- The medium and method of distribution.
- The firm's or associated person's history of communication concerns.
Where a firm allows categories to proceed without universal principal pre-use review, the proposal expects education and training, documented implementation, surveillance and follow-up. Firms would also maintain evidence that their procedures were carried out and make it available to FINRA on request.
What stays the same under the proposal?
The substantive content standards would remain. A faster route through the workflow does not create a lower standard for the communication itself. The firm would remain responsible for fair, balanced and non-misleading content, whether a person or an AI system drafted it.
This distinction matters. The proposal shifts the supervisory method from a single default route to a firm-designed risk model. It preserves the outcome standard and asks firms to evidence why each category receives its chosen level of review.
A practical risk model for retail communications
A working model can start with three routes. The lower-risk route would typically contain repeat communications built from an approved template, without a recommendation or performance claim, distributed broadly by a trained internal creator. Those communications could move through automated policy checks and an approved claim and disclosure library, with sample-based surveillance checking that the route continues to work.
The middle route would contain new creative, familiar product promotions, defined audience targeting and content involving third parties. It would still receive compliance review, but the review could be made faster by requiring substantiation and audience context when the asset is submitted. The decision record would then show the basis for approval without a reviewer having to reconstruct it later.
The higher-risk route would bring together complex products, recommendations, performance comparisons, personalised communications, finfluencer content and areas where the firm or creator has a history of concerns. Those communications would continue to receive qualified principal pre-use approval, specialist input where appropriate, stronger supporting evidence and closer post-use monitoring.
The names of the routes matter far less than the quality of the definitions. A framework becomes useful when two experienced reviewers can classify the same communication independently and reach the same answer. If one reviewer calls an asset routine and another calls it high risk, the firm still has an undocumented judgment problem hiding inside a new taxonomy.
How broker-dealers can prepare before the rule changes
The proposal is still open for comment, so firms should keep following the current rule. Preparation can begin without moving any communication out of its required approval route.
The safest place to start is in shadow mode. Firms can take communications through the current approval process while also classifying them under the proposed factors. That produces evidence about how the future model would have behaved without changing the route required today. It also reveals where a neat policy description breaks down when applied to actual campaigns.
1. Inventory the communications estate
Map every recurring content type: paid ads, organic social, emails, websites, app messages, webinars, sales collateral, influencer content and AI-generated interactions. Record the audience, product, creator, distribution method, use of performance and whether the content makes a recommendation.
The inventory should work at category level and asset level. Category-level mapping shows the repeated shapes of work entering the firm; asset-level data shows the exceptions within them. A standard market update, for example, may usually sit in a lower-risk category until one edition includes a performance comparison or a specific investment recommendation. The system needs to recognize the change in substance rather than relying on the label attached to the template.
2. Build the risk taxonomy on historical content
Apply the eight proposed factors to a sample of past communications. Compare the resulting tiers with actual review outcomes. The exercise shows where a streamlined route could be safe and where risk concentrates.
Use content from different creators, products and channels and include promotions that were amended, rejected or raised in a later review. Firms often discover that risk clusters somewhere unexpected: a familiar product with a new audience, a reliable internal team using performance for the first time, or an influencer reworking an approved script into language that creates a different overall impression.
3. Convert policy into actionable rules
Terms such as "complex product" or "tailored communication" need operational definitions. Translate them into fields, triggers and escalation logic that can be applied at submission. The compliance team should own and approve those rules.
The definitions also need owners and version histories. As products change and FINRA provides further guidance, the firm should be able to update a rule once, identify the categories affected and show when the new logic began applying. That is how a written supervisory procedure becomes part of daily work rather than a document consulted after an issue.
4. Attach evidence at the point of review
A claim involving performance, cost, ranking or product benefit should enter the workflow with its source. Reviewers can then assess the communication and its basis together. The record should preserve the final asset, source material, route, decision, approver and dates of use.
This is particularly important under a risk-based system because the evidence can affect the route itself. A familiar factual claim drawn unchanged from an approved source may qualify for a streamlined process. A new comparison built from selective data may require enhanced review. Capturing evidence at submission allows the workflow to distinguish between the two before a principal begins reading.
5. Design surveillance alongside faster approval
Streamlined review needs a feedback loop. Sample lower-risk communications, track exceptions by creator and category, and move categories into enhanced review when the data shows recurring concerns. Post-publication monitoring should also catch changes between the approved and live version.
Surveillance is where the model proves itself over time. A lower-risk route should keep its status because evidence shows that it performs reliably, rather than because it was labelled low risk during implementation. Exception rates, reviewer overrides, complaints and regulatory findings should all feed back into the criteria and determine whether a category, creator or channel needs a different level of scrutiny.
6. Test AI tools as part of the supervisory system
FINRA says generative-AI communication tools can form part of a reasonably designed supervisory system when they are vetted, tested and monitored. Firms should define validation ownership, monitor accuracy and hallucination risk, protect data and retain evidence of how the system performed.
Testing should reflect the communications the firm actually produces. A model can perform well on generic examples and still struggle with a firm's product language, disclosure rules or borderline recommendations. Historical decisions give the firm a stronger benchmark because they contain the context, revisions and judgment calls its own reviewers have already made.
What this means for marketing teams
A risk-based model gives marketing a clearer route through compliance. Teams gain speed by improving the quality and context of the submission: who will see it, what it promotes, which claim library it uses and what evidence supports it. Routine work can move quickly because compliance has already defined the boundaries.
That changes the role of compliance from reading every first draft to engineering the policy and escalation system around the work. Senior reviewers spend more time on complex products, novel claims and judgment calls, while repeatable checks happen consistently across the content estate.
The governance test is the real test
The quality of a risk-based model will be judged through its operation, rather than the elegance of the policy document. A firm should be able to take a communication selected at random and explain which factors applied, why it followed its route, what checks were completed, who had authority over the decision and how the firm monitored the result. It should also be able to show how recurring issues changed the system.
That evidence becomes more valuable as communication volumes grow. AI can create hundreds of variants quickly, and social teams can adapt content continuously. The supervisory framework needs to preserve a consistent line through those changes: the policy compliance wrote, the version marketing created, the checks the system completed, the exceptions a person considered and the communication an investor ultimately received.
The firms that prepare well will treat the proposal as an operating-model exercise rather than a chance to remove approval steps. The benefit is a more focused use of qualified principal time and a clearer route for marketing. The control is the system that connects both.
How Adclear supports a risk-based communications model
Adclear turns firm-owned rules, claims, disclosures and escalation logic into actionable checks across marketing workflows. Communications can be routed by risk, reviewed against the relevant policy and retained with a full evidence trail. Post-publication monitoring then compares live content with the approved position and raises changes or exceptions for review.
The same structure supports the current Rule 2210 process and a future risk-based framework: compliance stays in control of the policy, marketing receives earlier feedback, and the firm can show how its procedures operated.
FAQ
Has FINRA changed Rule 2210 already?
No. Regulatory Notice 26-14 requests comment on proposed changes. As of 2 September 2026, the comment deadline is 11 September 2026 and the current Rule 2210 remains in force.
Would the proposal remove principal review?
The proposal would require written procedures for principal review while giving firms flexibility to decide which retail-communication categories require principal pre-use approval. The decision would be based on risk and documented in the supervisory framework.
Can AI approve retail communications under the proposal?
FINRA says AI tools may form part of a reasonably designed supervisory system when vetted, tested and monitored. The firm remains responsible for the communication and the effectiveness of its procedures.
Which communications are likely to receive more scrutiny?
The proposed factors point toward complex products, recommendations, performance claims, comparisons, tailored communications, third-party promotions, finfluencer content and categories with a history of concerns.
Sources
- FINRA Regulatory Notice 26-14: proposed modernization of Rule 2210
- FINRA Rule 2210: Communications with the Public
This article is educational and does not constitute legal or regulatory advice. Firms should assess the proposal and current requirements with qualified counsel and compliance professionals.
Once you're booked in, we'll send you a free playbook on Financial promotions compliance for FinTechs.
