FCA Compliance Guide

FCA Compliance for Financial Services Marketing

The FCA ordered 19,766 financial promotions to be amended or withdrawn in 2024. That's a 97.5% increase year-on-year. Regulatory scrutiny of marketing communications has never been higher.

This guide covers the rules that matter most for financial services marketers: COBS 4, the Consumer Duty, crypto promotions, PECR consent and the enforcement trends shaping compliance priorities right now.

Built-in compliance for every campaign.

COBS 4

What is COBS 4 and how does it affect financial marketing?

COBS 4 is the section of the FCA's Conduct of Business Sourcebook that governs financial promotions. It applies to every FCA-authorised firm and sets the standard that all marketing communications about regulated financial products must meet.

The core requirement is straightforward: every financial promotion must be fair, clear and not misleading. That means balanced presentation of benefits and risks, unambiguous language the target audience can understand, and no false or deceptive claims. This applies across emails, landing pages, social media and every other marketing channel.

In practice, COBS 4 compliance calls for pre-approval workflows so promotions are reviewed before publication, content scanning to catch trigger terms and missing disclosures, and complete audit trails that show supervisory oversight. Firms relying on manual review alone are finding it harder to keep pace as the FCA ramps up enforcement.

Section 21 FSMA

Who needs FCA approval to issue financial promotions?

Under Section 21 of the Financial Services and Markets Act (FSMA), only FCA-authorised firms can communicate or approve financial promotions. Non-authorised firms must have their marketing approved by an authorised firm before it can be issued to the public.

Since February 2024, the FCA has tightened this further with a new approval gateway. Firms that approve third-party financial promotions now need a specific "approver permission" from the FCA. This closes a loophole where authorised firms would rubber-stamp promotions for unregulated businesses without proper oversight.

For marketing teams, this means every campaign involving regulated products needs a clear chain of approval: content creation, compliance review, then final sign-off by an appropriately authorised individual. Automated pre-approval workflows make this traceable and auditable without slowing down campaign timelines.

Consumer Duty

What does the Consumer Duty mean for marketing communications?

The Consumer Duty, effective since July 2023, requires firms to act to deliver good outcomes for retail customers. It applies to all marketing communications, not just point-of-sale materials, and raises the bar well beyond the existing "fair, clear and not misleading" standard.

The Duty focuses on four outcomes: products and services must meet the needs of the target market, price and value must be fair, consumer understanding must be supported by clear communications, and consumer support must be accessible when needed. Marketing campaigns that fail to consider these outcomes risk regulatory action even if individual promotions are technically compliant.

Vulnerable customers need extra consideration under the Duty. Firms must show that their communications are designed to be understood by the full range of their target audience, including those with lower financial literacy, cognitive impairments or emotional distress.

Enforcement landscape

FCA enforcement by the numbers

19,766 promotions

Financial promotions ordered amended or withdrawn in 2024. That's a 97.5% increase from 10,008 the year before, with the vast majority involving retail investments and lending.

GBP 176M+ in fines

Total penalties the FCA published in 2024 across 33 enforcement actions, up from GBP 53 million in 2023. The pace is picking up fast.

2,240 alerts issued

Alerts on unauthorised firms and individuals in 2024. The FCA reviewed over 3,700 websites and social media accounts for non-compliant financial promotions.

1,600+ websites blocked

Websites blocked, suspended or removed by the FCA in 2024 for promoting financial services without authorisation. Part of a wider scan of 480,000 potentially problematic sites.

Crypto regime

What are the FCA rules for crypto financial promotions?

Since October 2023, all crypto financial promotions in the UK must follow a dedicated regime under the Financial Promotions Order. The rules are among the strictest for any product category. Non-compliance carries unlimited fines and up to two years' imprisonment.

Every crypto promotion must include prominent prescribed risk warnings in standardised format with minimum font size requirements. Refer-a-friend bonuses are banned entirely. First-time crypto investors must be given a mandatory 24-hour cooling-off period before completing their investment, during which firms cannot send follow-up marketing designed to encourage the transaction.

Promotions must be issued or approved by an FCA-authorised firm, a cryptoasset business registered with the FCA, or meet specific exemption criteria. The FCA is actively building out a full crypto regulatory regime through 2026 and beyond, signalling that enforcement in this space will only intensify.

PECR

How does PECR apply to financial services email and SMS?

The Privacy and Electronic Communications Regulations (PECR) sit alongside GDPR and set specific rules for electronic marketing, including email, SMS and automated calls. For financial services firms, PECR compliance is a prerequisite for every marketing campaign, not an optional extra on top of FCA rules.

The default position is clear: you need specific, informed consent before sending marketing communications. The exception is the soft opt-in, which allows marketing to existing customers about similar products or services, provided they were given a clear opportunity to opt out when their details were first collected and in every subsequent message.

Here's the catch: a single campaign that breaches both FCA financial promotions rules and PECR consent requirements can trigger enforcement from both the FCA and the ICO. Granular consent management (tracking opt-in status per contact, per channel, per purpose) is essential for demonstrating compliance across both regimes.

Compliance requirements

FCA marketing compliance requirements

Fair, clear and not misleading

Approved by authorised person

Risk warnings prominently displayed

Balanced view of benefits and risks

Target audience clearly identified

Past performance disclaimers

Consumer Duty outcomes considered

PECR consent obtained

WORM-compliant records archived

Cooling-off periods enforced

Vulnerable customer protections

Audit trail for every campaign

Compliance automation

How compliance automation addresses FCA requirements

Pre-Approval Workflows

Every campaign goes through designated compliance officers before publication. Role-based approval queues with full version history and audit trails.

Risk Warning Management

Prescribed risk warning templates get auto-inserted based on product type and jurisdiction. Prominence validation checks that warnings meet minimum visibility requirements.

Content Compliance Scanning

Catches trigger terms, missing disclosures and misleading claims before campaigns go out. Rule sets are configurable per jurisdiction and product type.

WORM Archiving

Immutable Write Once, Read Many storage for every communication. Searchable, exportable records with a 5-year minimum retention period, extendable to 7 years at FCA request under SYSC 10A.

Cooling-Off Enforcement

Automatically holds follow-up marketing during the 24-hour cooling-off period for first-time crypto investors. No manual intervention needed.

Consent Management

Tracks consent per contact, per channel and per purpose with full audit trails. PECR soft opt-in logic and GDPR lawful basis management built in.

FCA compliance questions