Cold email compliance for UK financial services: PECR, UK GDPR and FCA financial promotions

Not legal advice. This guide summarises the rules as Rept applies them in its own campaigns. Check the current ICO and FCA guidance and take advice from your compliance officer or solicitor before relying on it.

Three sets of rules apply

B2B cold email in UK financial services sits under three regimes at once: PECR (the Privacy and Electronic Communications Regulations 2003) governs the sending of marketing email; UK GDPR and the Data Protection Act 2018 govern the personal data you process to send it; and the FCA financial promotions regime (section 21 of the Financial Services and Markets Act 2000 and the FCA Handbook) governs what you may say if the message invites or induces someone to engage in investment activity or consumer credit. Most compliance failures come from applying only one of the three.

1. PECR: who you may email

• Corporate subscribers are outside regulation 22. Limited companies, LLPs, Scottish partnerships and public bodies are corporate subscribers. You may send unsolicited marketing email to a named individual at a corporate subscriber without prior consent, provided you comply with regulation 23: do not disguise or conceal the sender, and give a valid address the recipient can use to opt out.
• Sole traders and ordinary partnerships are individual subscribers. In England, Wales and Northern Ireland, a sole trader or non-LLP partnership counts as an individual subscriber, so regulation 22 applies: you need prior consent or the soft opt-in (an existing customer relationship). Many financial services prospects, particularly small business borrowers, are sole traders. Rept classifies each target by legal form and excludes individual subscribers from cold campaigns unless consent exists.
• Every email needs a working opt-out. Honour it promptly and add the address and, where relevant, the company to a suppression list that every future campaign is checked against.
• The ICO enforces PECR and can fine up to £500,000 for breaches. Its guidance on business-to-business marketing and on direct marketing by electronic mail is the reference.

2. UK GDPR: the data behind the email

• A business email address that identifies a person is personal data. Sending to jane.smith@lender.co.uk is processing Jane's personal data even though the target is her company.
• Lawful basis is normally legitimate interests (Article 6(1)(f)). Document a legitimate interests assessment: the purpose (B2B marketing of a relevant service), the necessity (email is a proportionate channel), and the balancing test (a business contact would reasonably expect relevant B2B approaches; the data used is limited to name, role, company and work email).
• Transparency. Because the data was not collected from the individual, Article 14 requires that you tell them where it came from and how to object, either at first contact or within a month. A short privacy line and link in the email footer does this; Rept's policy is at rept.co/privacy.
• Right to object (Article 21) to direct marketing is absolute. An objection is treated as an opt-out and suppressed permanently.
• Minimise and retain sensibly. Hold only what the campaign needs, keep sources and dates, and delete unresponsive contacts on a defined schedule.

3. FCA financial promotions: what you may say

• The test is content, not channel. A financial promotion is an invitation or inducement to engage in investment activity (or, for consumer credit, to enter a regulated credit agreement). An email from a lead generation agency describing that a broker or lender exists and would like a conversation is generally not, by itself, a promotion of a specific regulated product. An email that quotes rates, terms, returns or urges the recipient to apply for a specific product usually is.
• If it is a promotion, it must be communicated or approved by an FCA-authorised person unless an exemption in the Financial Promotion Order applies. Many B2B messages to businesses rely on exemptions, but that is a judgement your compliance function must make, not your agency.
• Fair, clear and not misleading. COBS 4 (investment business), CONC 3 (consumer credit) and MCOB 3A (mortgages) set the standards for promotions in their areas. Claims about performance, guarantees and speed need substantiation.
• Agencies are not exempt from the regime. Rept's rule is simple: outreach describes the client, the problem it solves and an invitation to talk. Product terms, rates and application prompts are left to the client's own authorised, compliance-approved materials.
• Reference points: PERG 8 (the FCA's guidance on the financial promotion restriction), COBS 4, CONC 3, and the FCA's finalised guidance FG24/1 on promotions on social media, which applies the same principles to any digital channel.

A campaign checklist

• Classify every target by legal form; exclude sole traders and ordinary partnerships without consent.
• Send from clearly identified, dedicated domains that name the sender and the client.
• Include a one-click opt-out and a privacy notice link in every email; process opt-outs within 24 hours.
• Check every list against the suppression list before each send.
• Keep the message about the client and the conversation; keep product terms out of cold email.
• Have the client's compliance officer sign off the campaign templates before launch.
• Record the lawful basis, the legitimate interests assessment, data sources and retention period.
• Human-review any AI-drafted copy before it is sent; models can hallucinate claims.

How Rept applies this

Every Rept campaign is built to these rules: corporate-subscriber targeting with legal-form checks, dedicated sender domains, a valid opt-out and privacy line on every email, suppression lists honoured across campaigns, human review of AI-written copy, and a standing rule that Rept never makes product-level claims on a client's behalf. The FAQ answers the common compliance questions in less detail; this guide is the long version.