Email Marketing Compliance for Financial Services

Email marketing compliance for financial services in the UK and Ireland rests on four sets of rules: PECR or SI 336/2011 for permission to send, GDPR for the data behind each address, the FCA financial promotion rules for what the message says, and the Consumer Duty for how well customers understand it.

Most general guides stop at GDPR, which leaves banks, lenders, insurers and fintech firms exposed on the points regulators actually test. This guide from the content and strategy team at ProfileTree in Belfast sets out where each rule applies and where they overlap.

The sections below cover the legal framework, a consent journey that holds up under audit, the content of a compliant promotion, the technical side of sending, and the records you need to keep, followed by answers to the questions finance marketers ask most often.

The Rules That Govern Financial Marketing Emails

Three regimes apply to a single marketing email from a UK firm, and a fourth comes into play when the list includes Irish contacts. Each answers a different question, and confusing them is the most common reason a campaign that looked compliant fails a review.

How PECR and UK GDPR Divide the Work

The Privacy and Electronic Communications Regulations (PECR) decide whether you may send a marketing email at all. UK GDPR, the data protection law the UK kept after Brexit, governs how you collect and hold the personal data behind each address. A message can satisfy one law and breach the other, so both need checking before every campaign.

For individual subscribers, PECR requires prior consent unless the soft opt-in applies. The ICO guidance on direct marketing by email explains how the two laws interact, and it is the reference a regulator will expect your team to have read. Since 5 February 2026, when the relevant parts of the Data (Use and Access) Act 2025 came into force, PECR breaches carry the same maximum fines as UK GDPR: £17.5 million or 4% of global annual turnover, whichever is higher.

The Soft Opt-In and Why Finance Should Treat It with Caution

The soft opt-in lets you email existing customers without fresh consent, provided you obtained their details during a sale or negotiation, you are promoting your own similar products, and you gave them a simple way to refuse both at the point of collection and in every message since. All of those conditions must hold at once.

Financial products make the similar products test hard to pass. A customer who opened a savings account has not obviously agreed to hear about mortgages or investment platforms, and a regulator reviewing a complaint will read the test narrowly. Firms with several product lines usually fare better by relying on explicit consent for cross-selling and keeping the soft opt-in for close relatives of the original product.

What the FCA Consumer Duty Adds to Email

The Consumer Duty applied to open products from 31 July 2023 and to closed products from 31 July 2024. It asks firms to show that their communications help retail customers understand what they are buying and make decisions in their own interest, which turns email copy from a marketing matter into evidence the FCA can ask to see.

In practice, this means testing whether recipients understood a message as well as whether they opened it. Comprehension testing on key emails, with a record of what changed as a result, separates firms that have absorbed the Duty from those that have only read it. The FCA also expects outcomes to be monitored across customer groups, including people with characteristics of vulnerability, so a promotion that works for experienced investors but confuses first-time savers is a problem to fix.

Ireland’s SI 336/2011 and Cross-Border Lists

Ireland’s ePrivacy Regulations (SI 336/2011) follow a consent model close to PECR and are enforced by the Data Protection Commission (DPC). The Irish soft opt-in is narrower because it only covers customers who bought from you in the previous twelve months, and sole traders are protected as individuals, so only incorporated businesses can be emailed without prior consent.

For a Northern Ireland firm selling into the Republic, a single list may fall under both regimes. The practical answer is to tag each contact by jurisdiction at sign-up and apply the stricter rule wherever a record is unclear. That tag also makes it simple to prove which law you relied on if a complaint arrives from either side of the border.

Building a Consent Journey That Survives an Audit

Consent is only as strong as the evidence behind it. When a complaint reaches the ICO or the DPC, the firm has to produce the wording each subscriber saw and the moment they agreed to it, and that record begins on your website. A sound digital marketing strategy treats the sign-up journey as a compliance asset as well as a lead source, and the four parts below show what that looks like.

Designing Compliant Sign-Up Forms on Your Website

Every form that captures an address for marketing needs an unticked box and plain wording that names the kind of messages the subscriber will receive, with the privacy notice linked beside it. The ICO expects consent to be specific, so a vague promise of news and offers from a group of companies will not stretch to cover a sister firm’s credit products.

The guide to designing GDPR-compliant web forms covers the field-level detail, including timestamps and storing the consent text with each submission. A common example is a mortgage broker whose WordPress contact form also feeds its newsletter. Separating the enquiry consent from the marketing consent, and saving the exact wording shown alongside each entry, is a small development job that removes the weakest point in many broker audits.

Double Opt-In as the Evidence Standard

Double opt-in, where a subscriber confirms through a link sent to their inbox, is not required by PECR or GDPR. It is still the strongest evidence a firm can hold, because the confirmation click shows that the person who owns the address chose to join.

The trade-off is a smaller list, since some people never click the confirmation link. For a regulated firm, that cost is usually worth paying, because a single upheld complaint can absorb more staff time than those sign-ups would have repaid. Confirmed addresses also protect sender reputation by keeping mistyped and fake entries off the list.

Preference Centres and Suppression Lists

A preference centre lets subscribers leave one stream, such as product offers, while keeping another, such as market commentary. For firms with several product lines, it reduces full unsubscribes and produces a finer record of what each person has agreed to receive.

The compliance risk sits in synchronisation. If a preference change on the website takes days to reach the sending platform, the next campaign can go to someone who has already withdrawn, and the firm is answerable for that message, whatever the technical cause. Suppression lists, which hold addresses that must never be emailed again, should be shared with every platform and agency that sends on the firm’s behalf.

Consent Rules Compared across the UK, Ireland and the EU

The table summarises how the main jurisdictions treat consent for consumers and business contacts. Rules vary between member states across the wider EU, so firms mailing beyond the UK and Ireland should check national law for each market they reach.

What a Compliant Financial Promotion Email Contains

A clean list gets the email delivered, and the FCA rules then govern every word inside it. Section 21 of the Financial Services and Markets Act 2000 restricts financial promotions to those made or approved by an authorised person, and the FCA Handbook sets the content standards, with COBS 4 for investments and parallel rules in the sourcebooks for mortgages, insurance and consumer credit.

Passing the Clear, Fair and Not Misleading Test

Every financial promotion must be clear, fair and not misleading. Clarity means a reader without financial training can follow what is offered and what it costs, fairness means benefits never appear without the matching risks, and the misleading test covers every element of the email, including images and the sender name.

Financial confidence varies widely among adults, and the basic ideas many people missed at school, such as how interest compounds or why returns rise and fall, are exactly what a promotion tends to assume. Material written to teach money management to children is a useful reminder of how much plain explanation those ideas need before a reader can weigh an offer properly.

This is often where firms bring in content marketing support, so that writers who understand the FCA standards draft the promotion before the compliance team reviews it.

Ciaran Connolly, founder of ProfileTree, puts the principle this way: “Every claim in a financial email should be checkable, from the subject line down to the footer. If ProfileTree cannot point to where a figure came from, it does not go in. That rule costs words and keeps trust, and it is the standard ProfileTree’s content marketing team in Belfast applies to every regulated business it writes for.”

Subject Lines and the Problem of False Urgency

Subject lines form part of the promotion and are judged on their own. A line promising guaranteed returns fails even if the body explains the conditions, because many recipients will only ever see the inbox view, and preview text is assessed the same way.

False urgency is the other frequent failure. Deadlines that do not exist and countdown timers that reset create the kind of pressure the Consumer Duty’s rule on avoiding foreseeable harm is designed to prevent. If an offer really closes on a date, state the date; if it does not, leave the deadline out.

Footer Disclosures by Product Type

The disclosures a promotion needs depend on the product, and the table below covers the most common categories. Treat it as a starting point, because the firm’s compliance function signs off the final wording for each product and channel.

Risk Warnings That Read Properly on a Phone

Many recipients read email on a phone, where a footer can sit several screens below the offer. FCA rules require risk warnings to be prominent, and a warning that only appears after repeated scrolling is hard to defend in front of a supervisor.

Placing the main warning directly beneath the headline claim or the button, in body-sized text with strong contrast, keeps it in view alongside the benefit it qualifies. Test templates across the common mail apps and screen widths before launch, and save a screenshot of the rendered warning to the approval file as proof of how it appeared.

Email Authentication and Data Security

Compliance does not stop at the copy. The domain records that prove your emails are genuine, and the systems holding subscriber data, are part of what a regulator or a data protection authority will examine after an incident, so marketing and IT need a shared view of both.

SPF, DKIM and DMARC in Plain Terms

SPF (Sender Policy Framework) lists the servers allowed to send email for your domain. DKIM (DomainKeys Identified Mail) adds a digital signature showing the message has not been altered in transit, and DMARC tells receiving providers what to do with mail that fails those checks while sending you reports on who is using your domain.

For a financial brand, a DMARC policy set to quarantine or reject is the main technical defence against fraudsters sending phishing emails in its name. These are DNS records, so they sit with whoever manages the domain and website. On a hosting and maintenance plan, the records can be reviewed whenever the marketing team adds a new sending tool, which matters because a CRM or newsletter platform will fail authentication until its servers are added.

Mailbox Provider Rules for Bulk Senders

Since February 2024, Google and Yahoo have required bulk senders to authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe and keep reported spam low. Google defines a bulk sender as one sending around 5,000 or more messages a day to personal Gmail accounts and asks for spam rates below 0.3%. Microsoft introduced comparable requirements for Outlook.com addresses in May 2025.

Any firm with an active newsletter passes those thresholds quickly. Missing authentication now leads to rejected or junked mail rather than a polite warning, so a deliverability problem can quietly become a compliance problem when regulatory notices stop reaching customers.

Encryption and International Data Transfers

Choose a sending platform that encrypts mail in transit using TLS (Transport Layer Security) and can state where subscriber data is stored. If the platform holds data outside the UK, UK GDPR requires a lawful transfer mechanism, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement.

Irish firms follow the EU rules, under which the EU-US Data Privacy Framework has covered certified US providers since July 2023. In either jurisdiction, place the platform’s data processing agreement in the compliance file before the first send.

Record Keeping and the Cost of Getting It Wrong

The final part of a compliant programme is the paper trail. Regulators judge a firm on what it can produce, and the retention rules from the FCA and data protection law pull in different directions unless they are planned together from the start.

Retention Periods for Promotions and Consent Records

The FCA record-keeping rule for promotions, COBS 4.11 in the FCA Handbook, sets minimum periods according to the business the promotion relates to. Privacy law asks you to keep personal data no longer than you need it, so the two are reconciled by archiving promotion copies separately from live subscriber data.

Keep the suppression list to the minimum data needed to block an address, usually the address itself or a hashed version of it. That small dataset can be retained safely while the rest of the subscriber record is deleted on request.

Penalties from the ICO, the FCA and the DPC

The ICO’s higher PECR ceiling, described earlier, now applies to serious breaches of either law, and the regulator has a long record of penalising firms for unsolicited marketing email. The FCA acts separately: a promotion that breaches its rules can lead to fines, public censure or an order to withdraw it, and since February 2024 an authorised firm needs specific FCA permission before it can approve promotions for unauthorised businesses.

In Ireland, the DPC can prosecute unsolicited marketing under SI 336/2011 in the courts, where each message can count as a separate offence. That route sits alongside GDPR fines of up to €20 million or 4% of worldwide turnover.

A Review Routine Your Marketing and Compliance Teams Can Share

Most failures happen at the handover between teams, when marketing edits a subject line after sign-off or a new platform goes live without a consent check. A short shared checklist for every campaign closes those gaps.

• The subject line, preview text and body were approved together, and the approved version is the one scheduled.
• Every segment in the send has a recorded consent basis, and the suppression list was applied on the day of sending.
• Risk warnings and footer disclosures display correctly on mobile screens, with a screenshot saved to the approval file.
• The sending domain passes all three authentication checks, and the unsubscribe link works in a single click.
• A copy of the final email and its approval record has gone into the compliance archive.

A checklist works only when the people using it understand why each line is there. ProfileTree’s digital training can be built around a firm’s own forms, templates and sending platform, so staff finish with their consent capture and authentication already checked. ProfileTree is a Belfast web design and digital marketing agency, founded in 2011 and based at the McSweeney Centre, and the same principles apply to social posts and web pages, as set out in the guide to digital marketing compliance in financial services.

Making Compliance Part of Every Campaign

Email marketing compliance for financial services holds together when consent records, promotion copy, sending infrastructure and archives are designed as one system. Firms that build it this way spend less time defending individual campaigns and more time writing emails customers understand. If your sign-up forms, templates or domain records were set up before the Consumer Duty or the 2026 PECR changes, ProfileTree can review them with your compliance team and plan the fixes.

FAQs