FINRA Rule 2210 and Online Reviews: What Brokers Can and Can't Do

FINRA Rule 2210 testimonials are client statements of opinion about a broker-dealer's services — including online reviews a firm or rep highlights, shares, or responds to in a way that goes beyond a neutral acknowledgment — that count as the firm's own retail communication once the firm adopts them, triggering disclosure and recordkeeping obligations under 2210(d)(6). That distinction matters because a review sitting quietly on Google, written entirely by a client with no input from the firm, is not automatically a problem. The risk shows up the moment a branch manager reposts it, a rep replies in a way that echoes its claims, or a firm builds a marketing page around a handful of five-star quotes. Getting this right means treating every review that touches your brokerage business as a potential testimonial the second you do anything with it, and routing every review to compliance before replying rather than improvising a response in the moment. FINRA social media rules for broker-dealers, in plain terms FINRA Rule 2210 governs "retail communications" — essentially anything a broker-dealer or its registered reps distribute to more than 25 retail investors, which covers a firm's website, its social media presence, and increasingly its handling of third-party review content. The rule requires retail communications to be fair, balanced, and not misleading, and it layers on specific content standards depending on what the communication contains. Testimonials get their own carve-out under 2210(d)(6) precisely because a glowing quote from a client, taken out of context, can imply things about likely investment results that the firm could never say directly. This is a fundamentally different rulebook from the one that governs registered investment advisers. If your firm is purely an RIA with no broker-dealer affiliation, the SEC Marketing Rule — not FINRA 2210 — is the relevant framework; we cover that side in detail in Financial Advisor Google Reviews and the SEC Marketing Rule. Many independent advisory practices are dually registered, with some reps holding both an RIA hat and a broker-dealer hat, and in that case the safer approach is to apply whichever rulebook is stricter to a given piece of content, rather than picking the more permissive one. Rule 2210(d)(6) and what a testimonial disclosure requires Under 2210(d)(6), a testimonial used in a retail communication generally needs to disclose that the testimonial may not be representative of the experience of other clients, that it's no guarantee of future performance or success, and — if the person was compensated — the fact and nature of that compensation. The exact wording, placement, and thresholds FINRA expects are the kind of detail that gets refined through guidance and enforcement actions over time . The practical takeaway for a firm without its own compliance memo on this yet: don't publish a testimonial-style communication — a "what our clients say" page, a pinned glowing review, a social post quoting a client — without compliance sign-off on the disclosure language first. Regulatory Notice 17-18: why liking or sharing a review isn't neutral FINRA Regulatory Notice 17-18 addresses social media and digital communications specifically, and one of its central themes is that a firm or rep "liking," sharing, or otherwise featuring third-party content — including a customer's review — can turn that content into the firm's own communication, subject to the same content standards as if the firm had written it . That's the same "adoption" concept that shows up in the SEC's Marketing Rule guidance for RIAs, applied to a different rulebook. A rep scrolling past a nice review and hitting "like" might feel like a harmless gesture; under this framework, it can be read as the rep endorsing and republishing the content. Adoption and entanglement: the line between a client's speech and the firm's Two related ideas do most of the work here. Entanglement happens when the firm or rep is involved in creating or shaping a review before it's posted — suggesting language to a happy client, for instance. Adoption happens after the fact, when the firm embraces content it didn't create, by reposting it, quoting it in an ad, or replying in a way that affirms its specific claims. An unsolicited review sitting untouched on a third-party site generally stays the client's own speech. The moment a firm does something with it, that status is at risk of changing. A worked example: a repost that turns a review into a problem Consider a fictional broker-dealer, Marlow Financial Group. A long-time client leaves a five-star Google review on the profile of one of Marlow's branches: "My rep at Marlow doubled my account in three years — best decision I ever made." Left alone, this is the client's independent statement. But Marlow's branch manager, proud of the review, reposts it to the branch's LinkedIn page with a caption: "Results like this are why clients trust Marlow." That repost does two things at once. First, by adopting third-party content, the branch has turned the review into its own retail communication, which now needs to meet 2210(d)(6)'s testimonial disclosure requirements. Second, by amplifying a specific performance claim — "doubled my account" — the branch has effectively made its own performance claim, which brings a separate, stricter set of content standards into play, standards a public review written by a client was never designed to satisfy. The safer response to that same review is for the branch manager to leave a short, generic reply directly under it — "Thank you for your trust" — and to flag the review to compliance rather than repost it anywhere. Recordkeeping: why this doesn't end at the reply Broker-dealers are subject to SEC Rule 17a-4's recordkeeping requirements, which extend to retail communications, and a testimonial a firm has adopted or featured falls under that umbrella. In practice, that means a firm that engages with reviews at all — replying, reposting, or building marketing content around them — needs a system for retaining copies of the review, the firm's response, and any related compliance sign-off, for the retention period the rule requires . A review inbox that logs what came in and what went out as a reply does double duty here — it supports a calmer conversation with compliance and gives an examiner a clean record if one is ever requested. Why review volume looks thin for broker-dealer reps — and why that's normal If you compare a broker-dealer branch's review count to a retail business down the street, it will almost always look sparse, even at a branch that's doing well by every other measure. Part of that is the same privacy dynamic that depresses review volume across the whole wealth and tax industry: a client publicly confirming "this rep manages my investments" is implicitly disclosing that they have assets worth managing, which most people are reluctant to broadcast. Part of it is the compliance friction itself — reps who've been told, correctly, to be careful about reviews sometimes respond by avoiding the topic with clients entirely, rather than finding the version of asking that's actually compliant for their firm. A branch with a handful of recent, detailed reviews can be doing just as well reputationally as a competitor with many times that volume; the right comparison is to other broker-dealer branches, not to an unrelated retail category with a completely different disclosure picture. What stays constant no matter which rulebook applies Underneath all of the FINRA-specific detail, a few rules apply to every broker-dealer rep regardless of how their firm interprets 2210 or 17-18. Review gating — asking only clients you expect to be happy, or suppressing requests to clients who had a rough year — is illegal under the FTC's rule on fake and deceptive reviews, 16 CFR §465, for any business in any industry; see why review gating is a legal risk for the general mechanics. Incentivizing a review with a discount, a gift, or anything else exchanged for leaving feedback carries the same FTC exposure, and for a broker-dealal rep it layers a compensation-disclosure problem on top. Neither of those is a gray area that varies by firm policy — they're flatly prohibited everywhere. Building a workflow that survives a compliance review A few habits tend to separate firms that handle this well from firms that get surprised by it. First, nothing gets reposted, quoted in marketing, or featured on a website without compliance sign-off, no matter how good the review looks. Second, reps are trained to reply with short, generic language — a thank-you, never an echo of specific claims — and to escalate anything requiring real detail to a supervisor rather than improvising. Third, every review and every reply gets logged somewhere a compliance officer can find it later, satisfying both the spirit of 17a-4 and the practical need to answer questions quickly if a regulator asks. A tool that brings every platform's reviews into one inbox — rather than requiring someone to check Google, Yelp, and LinkedIn separately — makes that logging and that escalation path much easier to run consistently across a branch network. Training reps to recognize the moment a reply becomes a problem Most of the risk in this area doesn't come from reps deliberately trying to skirt the rules — it comes from a rep treating a review the way they'd treat a comment on their personal social media, without pausing to recognize that their professional capacity changes what a "like" or a reply means. A short, practical training point tends to do more good than a long policy document: before touching a review in any way — replying, liking, sharing, screenshotting it into a sales deck — ask whether this specific action could be read as the firm endorsing or republishing the content, and if the answer is anything other than a clear no, route it to compliance first. That single habit catches most of the situations this article describes, long before anyone needs to parse the fine distinctions between adoption and entanglement in the moment. Frequently asked questions Can a registered representative ask clients for reviews? It depends entirely on the firm. FINRA 2210 doesn't flatly prohibit solicitation, but many broker-dealers restrict or prohibit review requests through their own internal compliance policy, precisely because of the testimonial disclosure burden that follows. Check with your firm's compliance department before sending a single request — this isn't something an individual rep should decide alone. What should a rep do if a client posts an unsolicited review? Leave it alone beyond a short, generic public reply — a thank-you that adds no new claims and doesn't confirm details beyond what the review already states. Don't repost it, don't quote it in marketing, and flag it to compliance so it gets logged, especially if it contains a specific performance claim. Does "liking" a review count as adoption? Under the framework FINRA laid out in Regulatory Notice 17-18, it can. The safest assumption is that any visible interaction with third-party content — a like, a share, a reply that goes beyond a generic thank-you — carries some risk of being read as the firm's own endorsement, and should go through the same compliance thinking as a repost would. Where to go from here None of this is legal or compliance advice — it's a map of a real, active rulebook written so a rep or branch manager understands the shape of the problem before a review ever shows up. The specifics belong with your firm's compliance department or outside counsel, not a blog post. If you're on the RIA side of a dually registered practice instead, the relevant framework is the SEC Marketing Rule, covered in Financial Advisor Google Reviews and the SEC Marketing Rule. A single inbox that surfaces every new review the moment it posts — before anyone reposts or replies to it — is the easiest way to make sure compliance sees it first. See how Tailwind's mention tracking brings reviews, social mentions, and other public commentary into one place your compliance team can monitor. Every review from Google, Facebook and Yelp in one inbox → Try Tailwind free. Tailwind runs $5 a month per tool, or $50 a month for the Full plan covering every tool, with the first month free and no card required to start.