Financial Promotions Online: What FCA-Authorised Firms Need on Their Website

The starting point is one most firms accept in principle and forget in practice: a website page promoting a regulated product or service is a financial promotion. So is a LinkedIn post. So is a paid search ad, an Instagram story, and a meme.

The FCA's rules on financial promotions are media-neutral. They do not soften because the medium is short-form, informal, or built for engagement.

The FCA set out its expectations for social media in FG24/1, published on 26 March 2024, replacing the 2015 guidance FG15/4. The guidance does not create new obligations. It clarifies how existing ones apply to channels that did not exist when the rules were drafted, and it is unusually rich in worked examples of good and bad practice.

The fair, clear and not misleading standard

Every financial promotion must be fair, clear and not misleading. Since the Consumer Duty, the expected standard of care has risen further: promotions should support consumer understanding and good outcomes, not merely avoid technical inaccuracy.

For a website this means more than getting the facts right. It means:

• Benefits and risks presented with balance, not risks relegated to a footnote
• Risk warnings prominent, not minimised by design choices
• Language a retail customer can actually follow
• No implication of returns, safety or regulatory protection that does not exist

The FCA has been explicit that design and layout matter. A promotion where the risk warning is technically present but rendered in small grey text below the fold is not one where risk has been fairly presented.

Standalone compliance

This is the concept that causes most difficulty online, and it is worth getting precise about.

Each communication must comply with the rules when considered on its own. You cannot rely on information elsewhere to cure a deficiency in the communication the consumer actually sees.

The consequences online are significant:

A landing page must work alone. If someone arrives from a paid ad and lands on a product page, that page must be compliant in isolation. Risk information sitting on a separate page, reachable by a link, may not be enough.

A social post must work alone. A post that omits a required risk warning is not saved by the warning appearing on the linked page. Character limits are not an exemption — the FCA's position is that where a platform cannot accommodate a compliant promotion, the platform may not be appropriate for that product.

Sequential formats are difficult. Instagram stories, carousels and multi-part threads raise the question of whether the consumer will see the whole sequence. FG24/1 addresses this directly. The safe assumption is that they may see one part only.

Shared and re-shared content decontextualises. A post cropped or quoted elsewhere loses whatever surrounded it.

Websites: the specific problems

Several patterns cause recurring difficulty on FCA-authorised firms' sites.

Legacy pages. Products that closed years ago, rates that changed, permissions the firm no longer holds. Every published page is a live promotion until it is removed. A page inventory with an owner and a review date is the base control here, and many firms do not have one.

Homepage headline claims. The homepage is usually the least compliance-reviewed page on the site and the most likely to carry an unqualified performance or benefit claim.

Calculators and interactive tools. A projection tool produces a communication with each use. Assumptions, limitations and the non-advisory nature of the output all need to be clear at the point the result appears — not in terms and conditions elsewhere.

Cookie banners and consent gates that suppress risk warnings for users who decline non-essential cookies. Worth testing directly.

Testimonials and case studies implying typical outcomes.

Blog and thought leadership content that shades from commentary into promotion without anyone treating it as such. The perimeter question — is this a financial promotion? — should be asked of every published piece, not only of things labelled as marketing.

Third parties and influencers

FG24/1 gave particular attention to influencer marketing, and the position is stark.

An unauthorised person who communicates a financial promotion without approval from an appropriately authorised person may be committing a criminal offence. The FCA said so in terms, alongside the guidance.

For authorised firms, the responsibility is direct: firms remain responsible for the compliance of every promotion they make or cause to be made. Engaging an affiliate, influencer or agency does not shift that.

Practical implications:

• Any third party promoting the firm needs a written brief covering what may and may not be said
• Approved copy should be provided, not left to the third party to write
• Output should be monitored, not assumed
• Affiliate arrangements need review — affiliates paid on conversion have an incentive to overstate

The FCA has also noted that its scrutiny of financial promotions has intensified substantially, with tens of thousands of promotions amended or withdrawn following intervention in recent years.

Record-keeping

Firms must be able to evidence what was published, when, and who approved it. Online, this is harder than it looks.

Website pages change without versioning. Social posts are edited or deleted. Paid campaigns generate dozens of creative variants. Dynamic content assembles differently for different users. Personalised or A/B tested pages may mean no two visitors saw the same promotion.

An adequate approach records: the promotion as published, the date range it was live, the approver and the approval date, the target audience, and the sign-off rationale where a judgement was made.

The most common gap is website change history. A firm that cannot produce what its product page said in March has a records problem, not merely an inconvenience. Version control on the website — a proper content management workflow with an audit trail, rather than a page that is simply edited in place — solves this at source and is far easier than reconstructing it later.

What a workable process looks like

1. A page inventory of every published page, with an owner and a review date.
2. A perimeter check applied to all new content: is this a financial promotion? Documented either way.
3. Sign-off before publication by someone with the appropriate authority, recorded.
4. Standalone review — each asset assessed on its own, as the consumer will encounter it, including on mobile.
5. A design review covering prominence, contrast, placement and behaviour on small screens.
6. Version-controlled publishing producing an automatic audit trail.
7. Third-party controls — briefs, approved copy, monitoring.
8. A withdrawal process that can take a promotion down quickly and record that it happened.

Where marketing suppliers fit

Most website suppliers working with FCA-authorised firms have not encountered these requirements. The visible symptom is a build with no approval workflow, no version history, and a content management system that lets anyone with a login publish a live financial promotion.

That is not a compliance decision anyone made. It is a default, and it is the wrong default for an authorised firm.

The specification points that matter when commissioning a website:

• Draft, review and publish states, with role-based permissions
• Full revision history retained, with the ability to export a page as it appeared on a given date
• Scheduled review dates surfaced to content owners
• A defined path to unpublish quickly
• Records exportable for the compliance function without developer involvement

None of this is technically demanding. It simply has to be specified, and it rarely is.

Common questions

Is our website a financial promotion?
Any part of it that invites or induces engagement in investment activity is. Corporate and careers content generally is not. The perimeter guidance in FG24/1 addresses borderline cases, and the assessment should be documented.

Does this apply to B2B communications?
Some exemptions apply for communications to professional or eligible counterparty clients. The exemptions are specific and should be applied against the actual audience, not assumed from the channel — a public webpage does not have a filtered audience.

Can we use influencers at all?
Yes, with controls. The promotion must be approved by an appropriately authorised person, and the firm remains responsible for what is published. The risk is concentrated where the influencer writes their own copy.

Who approves financial promotions?
An appropriately authorised person within the firm, in accordance with its permissions and internal arrangements. This is a defined regulatory function, not a marketing sign-off.

---

TIKF Group builds and maintains websites for regulated firms, including approval workflow, version control and audit trails as part of the specification. Request an audit.

This article describes publicly available regulatory requirements and is not legal or compliance advice. Firms should verify current obligations against the FCA Handbook and FG24/1, and take advice from their compliance function.