AI and SEC Marketing Rule Compliance for RIAs

AI and SEC Marketing Rule Compliance for RIAs

What does AI marketing compliance for RIAs require?

AI marketing compliance for RIAs requires controls around what AI can draft, what evidence supports its claims, who approves publication, and which records your firm retains.

For a firm managing $50 million to $500 million in AUM, the opportunity is straightforward: publish useful content and follow up with qualified prospects without making your CCO review every sentence from scratch. The constraint is equally clear: AI does not transfer your regulatory responsibility to a vendor.

The SEC’s investment adviser marketing overview explains the rule’s general prohibitions and requirements for performance, testimonials, endorsements, and third-party ratings. Those requirements apply to covered advertisements whether a person or an AI agent produces them.

Registration matters. SEC-registered advisers must apply the federal rule; state-registered RIAs should confirm their applicable state requirements. Hybrid advisors and IBD representatives also need their broker-dealer’s supervisory procedures and applicable FINRA rules.

Your objective is not risk-free publishing. It is a repeatable, supervised process that makes mistakes easier to detect and decisions easier to reconstruct.

Which AI-generated communications need compliance review?

AI-generated communications need review based on their content, audience, distribution, and applicable rules, not simply because AI wrote them.

An RIA website offering advisory services, a prospect campaign, and a paid social advertisement can fall within the Marketing Rule’s definition of an advertisement. A routine scheduling email may present a different question. Do not label every communication an advertisement, or assume personalized messages are automatically outside the rule.

One-to-one communications are generally excluded from the first part of the advertisement definition, but hypothetical performance requires separate analysis and has limited exceptions. Compensated testimonials and endorsements also have their own treatment under the definition.

Give your agent a classification step before drafting:

• Audience: Prospects, existing clients, COIs, or internal staff.
• Purpose: Education, an offer of advisory services, account service, or a referral request.
• Claims: Firm facts, investment benefits, performance, or client experiences.
• Distribution: Website, email, social account, presentation, or third-party platform.
• Review route: Routine review, specialist review, or blocked pending clarification.

For IBD-affiliated advisors, align this classification with broker-dealer communication categories and approval requirements. FINRA’s guidance on generative AI emphasizes that existing obligations remain applicable when firms use these technologies.

How should an AI agent draft marketing from approved information?

An AI agent should draft from a controlled collection of approved facts and language rather than inventing details from an open-ended prompt.

Start with your services, fee descriptions, advisor credentials, investment philosophy, audience definitions, and current disclosures. Give every source an owner and review date. Treat changing information, such as AUM and team credentials, as expiring facts rather than permanent copy.

For example, an agent drafting a retirement-planning page should know whether your firm offers tax planning, coordinates with outside CPAs, or provides tax preparation through a separate entity. Those distinctions matter more than polished wording.

Set explicit drafting restrictions:

• Do not invent client results, credentials, awards, or custodian relationships.
• Do not promise investment outcomes or imply losses cannot occur.
• Do not add performance figures without an approved source and review route.
• Do not describe a service your firm does not actually provide.
• Do not use confidential client information in public-facing content.

Your RIA website marketing workflow should use the same approved facts as your email and social workflows. Otherwise, the agent can create inconsistent descriptions across channels.

For implementation priorities, use these strategies for deploying agentic AI in your RIA to define bounded tasks before expanding autonomy.

How can AI flag compliance issues without replacing your CCO?

AI can flag language, missing evidence, and disclosure gaps, but a qualified reviewer must evaluate context and decide whether the communication meets your firm’s standards.

Use deterministic checks for predictable issues, such as missing disclosure text or an expired AUM figure. Use AI for contextual questions, such as whether a headline emphasizes benefits while burying material limitations. Neither method should be treated as a legal conclusion.

Workflow stage	What AI can prepare	What your firm controls
Drafting	Copy based on approved sources	Permitted claims and source access
Screening	Flags for guarantees, omissions, and unsupported facts	Review criteria and escalation rules
Substantiation	Links between claims and evidence	Sufficiency and accuracy of evidence
Approval	A review packet and proposed corrections	Authorization under written procedures
Publishing	Delivery of the authorized version	Channels, permissions, and timing
Archiving	Content, metadata, and supporting records	Retention, completeness, and retrieval

Avoid a dashboard that simply labels content “compliant.” Require specific findings: which sentence triggered review, which policy applies, and what supporting material is missing.

Aspen Agent is a proactive AI marketing agent that runs work across your website, follow-up, content, reviews, and referrals. For regulated firms, that operating model should sit inside your approval and recordkeeping controls, not bypass them.

Before expanding AI publishing, map one campaign from source material to approval to archive, and test every handoff.

How should RIAs substantiate marketing and performance claims?

RIAs should connect material factual claims to reliable supporting records and apply separate checks to performance advertising.

The Marketing Rule prohibits a material statement of fact for which the adviser lacks a reasonable basis for believing it can substantiate the statement upon SEC demand. This does not require a particular software integration. It requires a defensible basis and retrievable evidence.

Create a claim-to-evidence register. For each claim, record its exact wording, source, relevant date, owner, and approved uses. An AUM statement might link to a dated firm report. A credential claim might link to a verification record.

Performance needs additional controls. Gross and net presentations, prescribed periods where applicable, related portfolios, extracted performance, and hypothetical results each raise specific requirements. A custodian statement alone may not establish that a marketing presentation satisfies them.

Build a substantiation folder containing the calculation inputs, methodology, applicable disclosures, supporting reports, and reviewed presentation. Block publication when a required record is missing or the presented figures differ from the reviewed version.

The SEC’s Marketing Rule adopting release provides the rule text and related recordkeeping amendments. Use it with your compliance counsel to establish requirements for your firm’s actual advertising, rather than asking an AI model to interpret every exception independently.

Can AI manage testimonials, reviews, and COI referrals?

AI can organize testimonial and referral workflows, but your firm must determine the applicable disclosures, oversight, agreement requirements, and disqualification checks.

Begin with intake. Record whether the speaker is a current client, whether compensation exists, what benefits are provided, and where the statement will appear. Compensation can include noncash benefits, so a payment field alone is insufficient.

The Marketing Rule permits testimonials and endorsements subject to conditions. Disclosure and oversight obligations apply, and written agreements and disqualification provisions have specific exceptions. Do not assume every unpaid review requires an agreement, or that a compensated COI introduction is merely informal networking.

AI can prepare a review packet, flag missing information, and attach proposed disclosure language. A reviewer should confirm that disclosures are clear and prominent and that the presentation is not misleading. Selecting only favorable reviews can raise concerns that disclosure alone will not resolve.

An unsolicited third-party comment is not automatically your advertisement. Your involvement, compensation, adoption, or entanglement can affect the analysis. Establish a policy for monitoring, sharing, embedding, and responding to reviews.

For a deeper process, use this RIA testimonial compliance guide before automating review requests or promoter outreach.

What should RIAs archive when AI creates marketing?

RIAs should retain required advertising records and enough supporting material to demonstrate what was published, how claims were supported, and how the firm applied its procedures.

At a minimum, design the workflow to capture the final advertisement and the supporting records required for that communication. Approvals, screening results, and version history can strengthen supervision and reconstruction, even when every intermediate draft is not independently required by the rule.

Your archive should connect:

1. The published content, including relevant visual disclosures.
2. Publication date, channel, and intended audience.
3. The authorized version and approval record under firm policy.
4. Evidence supporting material claims and performance calculations.
5. Applicable testimonial, endorsement, and promoter records.
6. Later corrections, replacements, or withdrawals.

Do not treat a Redtail or Wealthbox activity entry as proof that the full communication was preserved. Store an archive identifier in the CRM so your team can retrieve the underlying record.

Applicable advertising records generally require retention for at least five years, with specific timing and accessibility conditions. Confirm the precise requirements under Rule 204-2 and any additional obligations your firm faces. WORM storage is not a universal SEC requirement for RIA marketing archives; select controls that satisfy your applicable electronic recordkeeping requirements.

Test the archive by retrieving a changed website page and an email exactly as distributed. A file that exists but cannot be found is not a dependable control.

How can RIAs launch an AI marketing workflow safely?

RIAs can launch with a narrow, lower-complexity campaign and expand only after testing review, publishing, and recordkeeping controls.

Start with an educational campaign for a defined audience, such as executives approaching retirement. Exclude performance, testimonials, and individualized recommendations from the pilot. This reduces complexity, not every compliance obligation.

Connect only the CRM fields the workflow needs. Use approved vendors and access controls, and assess data handling, retention, and model-training terms before sending client or prospect information to an AI service.

Define stop conditions. If source material expires, approval is missing, or the archive connection fails, pause publication. If approved copy changes materially, route it back through the appropriate review process. Restrict publishing credentials so a drafting agent cannot approve its own work.

Measure review turnaround, correction rates, missing evidence, archive failures, and qualified prospect conversations. Those measures connect operational discipline to AUM growth without confusing faster output with better marketing.

Before expanding, run a retrieval exercise: select one published item and reconstruct its source, approval, distribution, and supporting evidence. If your team cannot do that reliably, fix the workflow first.

See how Aspen Agent runs this for your firm. Book a demo.